@mindrian_os/cli 1.13.0-beta.10 → 1.13.0-beta.44

package/CHANGELOG.md

@@ -1,3 +1,269 @@
+## [1.13.0-beta.44] - 2026-06-02
+
+### Fixed (release ceremony -- npx self-test false alarm, RULE 3)
+- **The release npx-publish self-test no longer aborts healthy releases.** Both `scripts/release.sh` Step 9.7 and the `doctor.cjs` `npx-roundtrip` acceptance check now verify the published package via `npm install @mindrian_os/cli@<version>` + assert `bin/cli.js` present, `node --check` parseable, and the `.bin/mindrian-os` symlink linked -- the true installability signal. They previously asserted `npx @pkg@version`'s launcher RUNTIME exit, which false-failed because (a) the installer shells to `claude`/`git` absent in the bare npx sandbox and (b) npm 10.9.7 npx-by-name does not reliably link the bin. This false alarm (RCA `release-step-9.7-npx-self-test-false-alarm`, open since beta.37) aborted every prerelease post-publish, forcing manual completion. Resolved per the RCA's recommendation A.
+
+### Added (release ceremony ruling system)
+- **`docs/RELEASE-CEREMONY-RULING-SYSTEM.md`** -- the authoritative release contract: slim-installer-package (RULE 1), npx-safe package name (RULE 2), install-ability self-test (RULE 3), mode-robust self-tests (RULE 4), 5-place + lockstep sync (RULE 5), beta-first infra (RULE 6), ordering + partial-release recovery (RULE 7), clean-tree/ahead guards (RULE 8), Canon boundaries (RULE 9), plus an operator runbook. Codified from the v1.13.0 finalize that hit four latent release bugs.
+
+## [1.13.0-beta.43] - 2026-06-02
+
+### Fixed (npx install UX -- proper npm package)
+- **`npx @mindrian_os/install` was broken; the npm package is renamed to `@mindrian_os/cli` and slimmed.** Root cause: the unscoped package-name segment `install` collides with the coreutils `/usr/bin/install` command, so `npx @mindrian_os/install` ran the system `install` (or failed `mindrian-os: not found`) instead of the installer. The package itself always worked via `npm install` + marketplace; only the `npx`-by-name path was broken (caught by the release Step 9.7 self-test on the 1.13.0 finalize). Fix: rename to `@mindrian_os/cli` (npx-safe; `cli` is not a system command), bin map `{mindrian-os, cli}` so `npx @mindrian_os/cli` resolves cleanly, and slim the published `files` from the entire 8.5MB plugin to the installer essentials (`bin/cli.js` + `lib/core/active-plugin-root.cjs`, ~164KB) since the CLI drives `claude plugin install` and never needs the plugin payload (that ships via the marketplace git artifact). README + install-minisite + release.sh + doctor.cjs npx self-tests all repointed to `@mindrian_os/cli`. The broken `@mindrian_os/install` beta.41/beta.42 are deprecated.
+
+### Fixed (release tooling)
+- **Pre-tag `release-dry-run-output` self-test is mode-explicit.** It ran `release.sh --dry-run` with no mode; during `--finalize` (after the version is bumped to a clean X.Y.Z) a bare dry-run exits 1, aborting the finalize. Now passes `patch` (valid on clean + suffixed versions).
+
+## [1.13.0-beta.42] - 2026-06-02
+
+This final rolls up the entire 1.13.0 beta train (beta.38 through beta.41, including the Windows installer fix below) plus the v1.13.1-planned dual-graph / research-workflow chain (Phases 130.5, 130.7, 131, 132).
+
+### Added (Phase 130.5 -- shared corpus-cache + CJS fetcher substrate)
+- **One CJS-native external-corpus module that every research surface uses.** `lib/core/research-corpus.cjs` exposes `fetchCorpus({source, query, limit})` over OpenAlex / arXiv / PubMed / Tavily (native `fetch`, zero new deps, zero Python) behind one interface, with a shared fail-closed Canon Part 8 pre-egress audit that rejects any query string carrying user-content patterns. `lib/core/research-cache.cjs` is the shared TTL + source-keyed on-disk cache so a paper fetched by `/mos:research` is never re-fetched by `rs-discovery-engine`. `rs-discovery-engine` migrated onto the shared module (byte-identical fixture results), closing the duplicate-fetcher / duplicate-quota drift. Sci-Bot registered as an opt-in `enabled:false` source (legal-review gated).
+
+### Added (Phase 130.7 -- correlation-id contract + dual-graph CI gates)
+- **A stable, embedding-independent `correlation_id` on every teaching-graph node.** Locked contract of record: `sha256(utf8(name + '|' + primary_label)).hex().slice(0,16)` (raw inputs, no trim/case-fold) - byte-identical to the live Brain backfill (721 nodes). `lib/core/correlation.cjs` is the single hashing chokepoint reused by the Brain backfill, the chain-recommender, and the local recommender. `lib/brain/chain-recommender.cjs` returns one canonical `{correlation_id, canonical_name, primary_label}` tuple per query (no cross-label fork); `navigation.cjs` memory_event references carry correlation_id (additive, zero new EVENT_TYPES); `bin/local-chain-recommender.cjs` walks aggregates by correlation_id. Ships the 4-metric dual-graph CI health gate (report-only/baseline mode) + three `/mos:brain-derive` curation surfaces (`--review-anchors`, `--orphan-census`, `--cross-label-dups`).
+
+### Added (Phase 131 -- research as a graph-aware workflow step, source-lens pilot)
+- **`/mos:research` rewritten from a prose-and-agent command into a 7-stage canonical workflow step.** Batched pre-flight (`navigation.getResearchPreflight`) -> Larry-voiced context summary -> weighted source-lens set -> corpus fetch via the 130.5 shared module -> F.1 filing selector (mirrors `selector-dispatcher.cjs`) -> findings wired as typed `EvidenceClaim` nodes with cascade edges (INFORMS / CONTRADICTS / SUPERSEDES / REJECTED_BECAUSE) landing on canonical correlation_ids. Rejection captures reason as graph data (Canon Part 4). 5 instrumented E2E tests drive the full pipeline through `navigation.cjs` with a zero-leak gate; `docs/RESEARCH-AS-WORKFLOW-STEP.md` makes this the template for the v1.14.0 source-lens fan-out.
+
+### Added (Phase 132 -- dual-graph correlation hypergraph reformat, machinery + tiny live cleanup)
+- **The teaching-graph curation machinery + the re-baselined live cleanup.** `lib/brain/curation-batch.cjs` is the reusable curation-batch runner (created_by provenance stamping, rollback-by-created_by, a write-time guard that refuses to write unless the 130.7 correlation contract is present in the live graph, gated `--execute`). Ships the frozen 5-event-type hypergraph schema, the dedup-collapse + held-name-rename machinery, and the Phase 132 release gate (invokes the 130.7 health check + brain-boundary-scan). Live cleanup executed the re-baselined worklist: collapsed the one real dedup pair (`The Other Way Round` Technique), snapshot-protected and reversible. The bulk hypergraph reify, the ~278-node wire-it, the internal-name pseudonymize, and the 14 held-node disposition are deferred to v1.14.0 (tracked deferred items; the held nodes remain safely quarantined).
+
+### Changed
+- Larry's chain-recommender now returns one canonical target per query across the LOCAL room.db navigation layer and the remote Brain teaching graph - the dual-graph coherence the v1.13.0 "Closed Loop" milestone was building toward.
+
+## [1.13.0-beta.41] - 2026-06-02
+
+### Fixed (Windows installer false-negative -- POSIX-shell assumption; debug session windows-posix-shell-assumption-installer-statusline, 2026-06-01)
+- **`npx @mindrian_os/install` no longer false-reports "Claude Code is not installed" on Windows when `claude --version` works in the same shell.** `bin/cli.js` spawned `claude` via `spawnSync('claude', ...)` with no `shell` option. On Windows the npm-global `claude` is a `claude.cmd` shim; Node's `spawnSync` does not consult `PATHEXT` without a shell, so the spawn failed with ENOENT and the installer's prerequisite check false-negatived (it then aborted before installing). The interactive shell consults `PATHEXT` and resolves `claude.cmd`, hence the contradiction the tester saw. Fix: a new `runClaude()` wrapper routes every `claude` spawn through `{ shell: process.platform === 'win32' }` so cmd.exe resolves the `.cmd` shim on Windows; the `requireClaudeCli()` `--version` check is shell-scoped the same way. All six `run('claude', ...)` call sites (install + update subcommands) now go through the single `runClaude` chokepoint. Confirmed live by a Windows 10.0.26200 tester on Claude Code 2.1.159.
+- **Scoping note (avoids a doctor-path regression):** the shell route is applied to `claude` spawns ONLY, not to the generic `run()` helper. `run()` is also called as `run(process.execPath, ...)` in the `doctor` subcommand, and on Windows `process.execPath` is `C:\Program Files\nodejs\node.exe` (contains a space); with `shell:true` Node would pass the command unquoted to cmd.exe, which would parse `C:\Program` as the command and break. `git` (a real `.exe`) and `process.execPath` resolve correctly without a shell, so they are deliberately left shell-free. POSIX behaviour is unchanged (shell stays false off-win32).
+
+### Known follow-up (tracked, not in this release)
+- **Statusline does not render on Windows without `bash` on PATH.** The `statusLine` command in `~/.claude/settings.json` runs `bash "${CLAUDE_PLUGIN_ROOT}/scripts/statusline-mos"`, and the dispatch shim + renderer are both bash. A default Windows box has no `bash`, so the status bar silently does not render (cosmetic -- the plugin and all `/mos:` commands function regardless). Same POSIX-shell-assumption family as the installer bug, different mechanism. The durable fix (a Node statusline renderer so the bar does not depend on bash) is scoped as its own phase. Interim: install Git for Windows (provides bash) or accept no status bar. See `.planning/debug/windows-posix-shell-assumption-installer-statusline.md`.
+
+## [1.13.0-beta.40] - 2026-06-01
+
+### Added (Brain schema awareness -- four new teaching edge types wired into Larry's reference layer)
+- **Larry now knows about, and actively traverses, four relationship types added to the Brain teaching graph during the 2026-06 curriculum work: `HAS_EXAMPLE`, `HAS_METHOD`, `CONTRASTS_WITH`, `DIRECTS`.** Verified live against the production Neo4j (`my-neo4j` MCP) before wiring: `HAS_EXAMPLE` 28, `HAS_METHOD` 4, `CONTRASTS_WITH` 2, `DIRECTS` 1, `REVEALS` 44 -- every count matches what was created, no drift.
+- **`references/brain/schema.md`** Node Types table now documents the labels that existed in the schema but were previously zero-instance and are now populated: `Method` (94), `Stage` (74), `Insight` (13), `Question` (8), `PyramidLevel` (5), plus the new `example_type` property on `Example`. Relationships table gains the four new edges with From->To, properties, and a "why it matters" note that tells Larry when to reach for each.
+- **`references/brain/query-patterns.md`** gains pattern `2b. brain_framework_teach` -- the invocation surface. Pulls worked examples (`HAS_EXAMPLE`), alternative methods (`HAS_METHOD`), the revealed insight (`REVEALS`), and rival theories (`CONTRASTS_WITH`) attached directly to a framework, so "show me an example / what are my options / why does this matter" resolve from the graph. Documents the Ackoff `(:PyramidLevel)-[:DIRECTS]->(:PyramidLevel)` top-down DIKW traversal.
+
+### Canon
+- Canon Part 8 clean by construction: schema/query-pattern reference docs carry only generic framework handles and edge-type names; zero user data, zero LOCAL->BRAIN egress.
+
+## [1.13.0-beta.39] - 2026-05-31
+
+### Fixed (topology-blind SessionStart banner -- debug session doctor-class-a-drift-topology-blind-false-positive, 2026-05-31)
+- **SessionStart no longer prints a false "MindrianOS install dir missing; run /mos:doctor --fix to recover" banner on healthy marketplace-cache installs.** The class A drift check in `scripts/doctor.cjs` (which feeds the SessionStart preflight banner via `scripts/doctor-preflight-format.cjs`) keyed off the hardcoded legacy `INSTALL_DIR` (`~/.claude/plugins/mindrian-os`) instead of `resolveActivePluginRoot()`. Under the modern marketplace-cache topology that legacy directory is correctly absent (Claude Code loads the plugin from the cache path recorded in `installed_plugins.json`), so the check reported false `install-missing` drift on every session while the topology-aware class I gate (`--install-state`) reported healthy. Worse, the banner's recommended remedy (`/mos:doctor --fix`) would have recreated the legacy directory, which the class I gate then flags as a migration candidate to remove -- the two subsystems contradicting each other. Fix: the `install-missing` drift branch and the `--fix` recovery gate are now guarded on `resolveActivePluginRoot().topology !== 'marketplace-cache'`, so a missing legacy directory is no longer drift when the active install resolves to a healthy marketplace-cache root. The legacy/dev-topology recovery path is preserved (a genuinely-missing legacy active root still reports `install-missing`). Class A now agrees with class I. Reuses the existing `lib/core/active-plugin-root.cjs` resolver (Canon Part 7); zero Brain wire (Canon Part 8 clean by construction). New regression suite `tests/test-doctor-class-a-topology-drift.cjs` (3 hermetic scenarios, registered in the Feynman runner) plus two existing doctor suites pinned to `MINDRIAN_OS_ROOT` for host-topology hermeticity.
+
+## [1.13.0-beta.38] - 2026-05-31
+
+### Added (Phase 135 -- the offer loop's resolver: Larry offers one calibrated next move, or stays silent)
+- **`resolveOfferNextStep` is now live -- the navigation engine offers exactly one next-move command at the right moment instead of always returning null.** Fills the Plan 91-04 stub with an abstention-gated resolver in the new `lib/core/navigation-engine-offer.cjs`. The offer renders through the shipped F.1 AskUserQuestion selector (one keypress, Free-Text escape), and each pick records a typed decision edge via `recordSelectorDecision` (Canon Part 4). Local-only and synchronous (no Brain call on the hot path); zero TUI, zero third-party dependency; works identically on CLI / Desktop / Cowork.
+- **The resolver is SQL-local, Brain-aware, MD-aware, and wikilink-aware.** Reads room.db only via the `navigation.cjs` chokepoint (Canon Part 9), consuming the local graph neighborhood + `memory_event` tail for relevance; consumes the MINTO governing thought + FEYNMAN temporal section + active JTBD (Canon Part 4); the offer reason cites the target section as a `[[wikilink]]`, and an accepted offer that files an artifact injects wikilinks idempotently (Phase 76 engine). Mode A enriches via the typed Brain packet (enum/handle only), Mode B degrades to local heuristics, tier_0 falls to the minimal verb set -- no crash across all three. Canon Part 8 boundary verified clean.
+- **Abstention is the load-bearing wall: operator-state x confidence-margin x rejection-backoff.** Silent in JUST_TALK; offers at decision moments; backs off a rejected offer (the reject writes the `memory_event` that suppresses it next turn). A wrong offer trains the user to ignore offers, so the resolver stays quiet unless it is confident -- protecting the credibility of the variable reward.
+
+### Context wiring (the dark-loop fix)
+- **The `decide()` context now carries the resolver's full input set** (operator, sectionPath, problemType, active JTBD, and a room.db-backed roomState) so production offers carry a real `[[section]]` reason instead of `[[undefined]]`. An end-to-end wiring test seeds a real temp room.db on a DECISION_GATE turn and asserts a non-null grounded offer, with a JUST_TALK null negative control -- the guard that catches the green-in-test / dark-in-production class.
+
+## [1.13.0-beta.37] - 2026-05-31
+
+### Added (room-wiring -- the single "wire all rooms" command)
+- **`scripts/heal-command.cjs --recursive` heals every registered room in one pass.** Reads `~/MindrianRooms/.rooms/registry.json` (honoring `MINDRIAN_ROOMS_HOME`), skips archived/sealed rooms, runs the full heal per room. Idempotent and per-room-failure-tolerant -- the sweep never aborts on one bad room. This is the command to run after any version that touches the room.db substrate.
+- **Heal now runs the Phase 130 hats->room.db migration as step 11.** Every heal invokes `migrate-hats-to-roomdb.cjs` after the lazygraph rebuild creates `room.db` (step 4), so heal becomes the single per-room wiring command -- the migration is no longer an orphaned script a human must know to run. Idempotent via its sentinel `memory_event` (re-runs skip).
+
+### Changed
+- `--skip-step` cap raised from 10 to 11 to cover the new hats-migration step.
+
+## [1.13.0-beta.36] - 2026-05-31
+
+### Fixed (Windows tester crash -- reported by Gary Laben on beta.34)
+- **`/mos:doctor --brain-smoke` no longer crashes the Node process on Windows.** On the L3 schema-probe failure path (a revoked or invalid Brain key returns 401/403), `lib/core/brain-client.cjs` did not drain the response body, so undici kept the TLS socket alive as a libuv handle; the synchronous `process.exit(code)` in the `--brain-smoke` dispatch then tore that handle down mid-close, which Windows libuv asserts on (`src\win\async.c` line 76, surfacing to the Claude Code Bash wrapper as exit 127). Linux/macOS silently discard the handle, so the crash was Windows-only and read as catastrophic when the real cause was just an invalid key. Fix: `scripts/doctor.cjs` sets `process.exitCode` and returns instead of calling `process.exit()` (lets the event loop drain handles the OS-safe way), and `brain-client.cjs` drains the body via `await res.arrayBuffer()` on the non-OK branch of `_ensureSession` and `callTool`. A failed probe now reports cleanly with exit code 1. Debug session: `.planning/debug/doctor-brain-smoke-win-crash.md`.
+
+### Added (v1.13.1 memory cluster -- Canon Part 9 "the local mind" made real: Phases 128 / 129 / 129.5 / 130)
+- **Phase 128 substrate-contract-adr -- navigation.cjs is now the structurally-enforced single door to room.db.** Ships `docs/architecture/SUBSTRATE-CONTRACT.md` (the four-substrate ADR plus the pinned navigation.cjs export allow-list) and `scripts/check-substrate.cjs`, a pre-commit CI guard wired into the live hook that blocks any net-new code bypassing the chokepoint (direct sqlite require, raw INSERT/UPDATE/DELETE on nodes/edges/memory_event, `openGraph` opener, Cypher user-interpolation). The guard is net-new-aware and self-allowlisting; `docs/architecture/SUBSTRATE-BASELINE.md` enumerates the 195 pre-existing bypasses with per-phase ownership. Closes dog-food review findings C3 / H1 / M11.
+- **Phase 129 spine-repair-memory-event -- the proactive loop's backward arc is closed.** The spine surfaces (`/mos:status`, `/mos:suggest-next`, `/mos:act`, `/mos:pipeline`, `/mos:jtbd`, `/mos:operator`, `/mos:memory`) now journal every state transition to the canonical `memory_event` log via navigation.cjs (5 net-new event types + the `FOLLOWS_FROM` cascade edge). `lib/conversation/operator.cjs` retired its raw `node:sqlite` bypass to the chokepoint. An instrumented acceptance test proves the full loop emits the expected events leak-free. Closes review findings C2 / H3 / M9.
+- **Phase 129.5 truth-machine-activation -- "the human confirms truth" is wired (Canon amended to v1.5).** The dead `promoteNodeStatus` lever is now reachable through exactly one door, `confirmNode(db, id, byUser)`. A human APPROVE is the only path to a `confirmed` truth-claim node; `byUser` resolves from the room USER.md navigator identity and agent identities (larry / brain / system / assistant) are rejected. `getConfirmedFacts` returns freshly-confirmed nodes. Canon Part 9 gains the audit-node carve-out. Closes review finding C1 (the highest-value gap).
+- **Phase 130 lens-engine-skeleton -- 18+ duplicate lens-rotation surfaces collapse to one engine.** Ships `lib/core/lens-engine.cjs` (serial/parallel/single modes + 5-family registry, cognitive populated) and 3 consolidated synthesizers. The 4 cognitive-family commands become thin clients; the hats family retired its `.mindrian/hats/*/STATE.md` filesystem writes to room.db `HatState` nodes. `INFORMS` + `REJECTED_BECAUSE` (rejection-as-data, Canon Part 4) added to the edge allow-list. Closes review finding H2.
+
+### Changed (Phase 128 guard hardening -- dog-food finding, caught on its own next commit)
+- The Phase 128 substrate guard shipped too blunt and blocked the very next legitimate commit. Hardened the same session: `check-substrate.cjs --diff` is now net-new-line-aware (parses `git diff --cached --unified=0`, flags only added lines), self-allowlists its own source and `check-schema-aliases.cjs`, and carries net-new regression tests. Canon Part 6 working as written: the product caught its own defect by dogfooding the guard.
+
+## [1.13.0-beta.34] - 2026-05-25
+
+### Fixed (JTBD auto-anchor silent-failure bundle, Phase 127.3 -- ships v1.13.0-beta.34)
+- **PRIMARY: JTBD memory layer was silently dead in every release since v1.11.x (commit fcbbcf9a, 2026-04-26).** `scripts/jtbd-update.cjs::resolveActiveRoom()` at lines 65-79 read against an obsolete registry shape (expected `reg.active_room` + Array `reg.rooms`; actual `reg.active` + Object `reg.rooms` since at least Phase 100). Both checks failed on every call, the function returned null, `main()` short-circuited at line 132, the classifier never ran, `.mindrian/jtbd-state.json` never got written, and `/mos:memory` reported `in_flight: 0 / parked: 0 / completed: 0` for ~7 months. Refactored both broken registry walks in `scripts/jtbd-update.cjs` (lines 65-79 top-level resolver + lines 196-214 Phase 103-05 promote block) to import + call the new `lib/core/resolve-active-room.cjs` chokepoint. `/mos:memory` now populates with real `in_flight` entries on the 3rd same-cue turn instead of reporting `0/0/0` forever. Full RCA: `.planning/debug/resolved/jtbd-auto-anchor-silent-failure.md`.
+- **SECONDARY: fresh-room creation now seeds USER.md, STATE.md, ROOM.md, and `.mindrian/`.** Previously every fresh room had `intent_persona = all-null` in every decision trace because `intent-classifier.cjs` had no USER.md to read from. `scripts/room-registry create` now seeds USER.md (canonical_role: null), STATE.md (empty Decisions section), ROOM.md (per Canon decision 15), and the `.mindrian/` directory idempotently. Per D-02, `jtbd-state.json` and `operator-state.json` are explicitly NOT seeded so legitimate first-write events stay in audit logs.
+- **TERTIARY: existing rooms get a one-time retro-bootstrap.** Jonathan's MindrianRooms canonical rooms + every tester's rooms + every CI fixture are retro-seeded with USER.md / STATE.md / ROOM.md / `.mindrian/` via the new `bash scripts/room-registry bootstrap-missing` subcommand, auto-triggered once on first post-127.3 invocation via a `~/MindrianRooms/.rooms/.bootstrap-127.3-done` sentinel. This closes the silent-failure gap for the ACTUAL population, not just rooms created after this release.
+- **QUATERNARY: first-touch JTBD nudge for fresh-room users.** On SessionStart, when an active room exists AND `.mindrian/jtbd-state.json` is absent AND ROOM.md mtime is under 7 days, Larry asks "What are you trying to do here?" with a `/mos:jtbd set <id>` hint. Past 7 days the nudge stays silent (deliberate-blank-room respected per D-03). Effective on both newly created rooms AND retro-bootstrapped existing rooms (where ROOM.md mtime reflects the moment the retro-pass stamped the room's identity).
+
+### Changed (JTBD auto-anchor silent-failure bundle, Phase 127.3 -- ships v1.13.0-beta.34)
+- **Canon Part 7 extraction: `lib/core/resolve-active-room.cjs`** as the chokepoint for active-room registry resolution, mirroring the precedent set by `lib/core/resolve-brain-key.cjs` (Phase 123 Plan 07). Tolerates both legacy (`reg.active_room` + Array `reg.rooms`) AND current (`reg.active` + Object `reg.rooms`) shapes; returns `{ slug, abs_path }` or null. Phase 129 (spine-repair-memory-event) will absorb the remaining 6 spine scripts (`mos-status`, `suggest-next`, `act`, `pipeline`, `operator`, `memory`) plus the deferred multi-room iteration site (`scripts/memory-completion-detector.cjs`) onto the same helper in v1.13.1-beta.3, so 127.3 lands the infrastructure 129 reuses without double-work.
+- **Consolidated 6 sibling registry-resolution sites onto the chokepoint:** `scripts/jtbd-update.cjs` (x2 sites), `scripts/intent-classifier.cjs`, `scripts/hmi-compliance-poll.cjs`, `scripts/jtbd-command.cjs`, `scripts/operator-command.cjs`, `scripts/check-onboard-statusline.cjs`. Structural tripwire `tests/test-127.3-sibling-sweep.sh` prevents the broken pattern from regrowing: any future PR that introduces `reg.active_room` or `Array.isArray(reg.rooms)` outside the two-file allow-list (the chokepoint itself + the Phase-129-deferred `memory-completion-detector.cjs` with a `# TODO Phase 129` marker) fails CI immediately.
+- **Empirical regression test `tests/test-jtbd-auto-anchor-empirical.sh`** reproduces the RCA "Reproduction Steps" protocol verbatim and serves as the behavioral gate. Phase 127.3 aggregator `tests/run-all-127.3.sh` runs all 3 Phase 127.3 test suites (chokepoint unit-test + sibling-sweep tripwire + empirical reproduction); `lib/memory/run-feynman-tests.cjs` registers the chokepoint unit-test so every Feynman pass picks it up.
+
+### USER-FACING NOTE (Phase 127.3)
+If you previously ran a Larry session in a fresh room and `/mos:memory` reported `in_flight: 0` even after multiple JTBD-relevant turns, this fix restores the auto-anchor mechanism. After upgrading, the FIRST time you run any `room-registry` subcommand (or open any room), the system retro-seeds USER.md / STATE.md / ROOM.md / `.mindrian/` on every existing room AND fires the first-touch nudge for rooms without a declared JTBD. No manual migration needed.
+
+## [1.13.0-beta.32] - 2026-05-24
+
+### Fixed (Windows-tester regression bundle, Phase 127.2 Plan 04 -- ships v1.13.0-beta.32)
+- **Instance #4 (P2): `/mos:rooms list` works on Windows + Git Bash (`scripts/room-registry` POSIX path leak).** Every `python3 -c` invocation in `scripts/room-registry` (8 subcommand stanzas: `create`, `read`, `list`, `update`, `set-active`, `archive`, `get-active`, `git-config`) interpolated bash-resolved `$REGISTRY_FILE` into Python source. On Git Bash for Windows, `$HOME=/c/Users/PC` produced paths like `/c/Users/PC/MindrianRooms/.rooms/registry.json` that Windows Python `open()` could not resolve, surfacing `FileNotFoundError` on every registry subcommand. Fix: inlined a `normwin()` Python shim at the top of every block, platform-gated on `sys.platform == 'win32'` so it is a no-op on Linux/macOS but converts the POSIX form to native `C:\Users\...` on Windows; every `open(...)` rewritten to `open(normwin(REGISTRY_FILE))`. Sibling sweep patched `scripts/reapply-modifications` (4 `python3 -c` sites, single `$NORMWIN_SHIM` bash-var-string reused). Explicit sweep targets (`scripts/hsi-*`, `scripts/build-*`, `scripts/release.sh`) verified clean. Out-of-scope sibling sites in `scripts/verify-release`, `scripts/learn-from-usage`, `scripts/track-analytics` logged to `.planning/phases/127.2-.../deferred-items.md` for a future patch beta. Silent for non-Windows users; caught only on Jonathan's dogfood Windows box. Closes `.planning/debug/resolved/windows-room-registry-path-normalization-gap.md`.
+- **Instance #7 (P1, META-FIX): `/mos:update` atomically swaps to the new active install + warns about session restart (silent-activation gap closed).** `/mos:update` and `claude plugin update mos@mindrian-marketplace` land new bytes in `~/.claude/plugins/cache/mindrian-marketplace/mos/<NEW_VERSION>/` but DO NOT atomically swap the live install at `~/.claude/plugins/mindrian-os/`. Every subsequent MCP probe + statusline + hook output continued to serve the OLD bytes. Users thought they were on beta.N+1; every Brain interaction silently read beta.N. This is the structural reason every prior beta this session may have been unverified on tester wires. Three-part fix: (a) new `scripts/post-update-activation.cjs` (305 lines, exports `activatePostUpdate` + `POST_UPDATE_TOUCH_FILE`) detects the cache-staging dir + delegates the atomic swap to existing `scripts/doctor.cjs --fix` (Canon Part 7 reuse of Phase 95.2 install-cache-atomic-recovery, three autopsies of hardening) + writes a touch-file at `~/.mindrian/post-update-restart-pending` with the new version + emits a Shape E action report; (b) new SessionStart hook `scripts/sessionstart-post-update-preflight.cjs` (187 lines, sibling-NOT-replacement of `sessionstart-npm-reconcile.cjs`) reads the touch-file each session, spawns `doctor --brain-smoke --json`, parses L4 MCP stdio handshake server-version token, deletes touch-file silently on match, refuses Larry-load with a red banner via SessionStart `systemMessage` envelope on drift (exit 1), exits 0 silently when probe is inconclusive (defensive); (c) `commands/update.md` Step 7 calls `node "${CLAUDE_PLUGIN_ROOT}/scripts/doctor.cjs" --fix --post-update` at the end of every update flow; `scripts/doctor.cjs` gains `--post-update` flag handler that delegates to the activator, composable with `--fix`. Closes `.planning/debug/resolved/mos-update-silent-activation-gap.md`.
+
+### Changed (Release pipeline self-defense, Phase 127.2 Plan 04)
+- **`/mos:doctor --acceptance` Class N gate: `activation-reached-the-wire`.** `scripts/doctor.cjs` gains a new acceptance point (severity `blocker`, `applies_to: ['full']`) that asserts the L4 MCP server version (probed via `doctor --brain-smoke --json` -> parse `server=mindrian-brain vX.Y.Z` from L4 handshake reason) matches `package.json.version` (version-of-record). On match: pass. On drift: fail with `activation gap detected: live install serves v<OLD> but version-of-record is v<NEW>`. Wired into the existing acceptance roster so `scripts/release.sh` Step 9.8 (post-publish full acceptance gate) runs this check AFTER the new version is published -- catching any phantom-version release before it propagates to tester caches. This is the canary the release pipeline never had: every beta after v1.13.0-beta.32 either activates on the wire AND earns the acceptance pass, or fails the gate AND is prevented from shipping. The cadence-vs-validation trade-off becomes structurally enforced rather than relying on manual maintainer discipline. Test environment hooks: `DOCTOR_TEST_FAIL_POINT=activation-reached-the-wire` synthesizes a failure; `DOCTOR_SKIP_ACTIVATION_GATE=1` marks the point ok-as-skipped for hermetic CI / offline mode.
+
+### Internal (Phase 127.2 Plan 04)
+- **`hooks/hooks.json`** registers `sessionstart-post-update-preflight.cjs` as a SessionStart hook (matcher `startup|clear|compact`, `async: false`, ordered AFTER `sessionstart-npm-reconcile.cjs` so node_modules is in place before brain-smoke spawns, BEFORE Larry-load so a drift blocks the room).
+- **New tests (60 PASS / 0 FAIL across 3 suites):** `tests/test-room-registry-windows-path.cjs` (215 lines, 25 PASS -- linux regression + python normwin functional probe + structural greps confirming zero raw `open($REGISTRY_FILE)` callsites remain); `tests/test-mos-update-activation-gap.cjs` (233 lines, 19 PASS -- cold synthesis of beta.N -> beta.N+1 atomic swap + idempotency on already-on-latest + preflight hook semantics); `tests/test-127.2-04-windows-path-and-update-activation.sh` (88 lines, 16 PASS -- structural greps + functional doctor probes).
+- **3 RCA closeouts moved to `.planning/debug/resolved/`:** `post-beta30-regression-2026-05-23.md` (12-gate wire-verification sweep), `windows-room-registry-path-normalization-gap.md` (Instance #4 detail), `mos-update-silent-activation-gap.md` (Instance #7 detail). Each updated with `status: resolved`, `resolved: 2026-05-23`, `resolved_by: phase-127.2 Plan 127.2-04`, plus Resolution sections linking to this plan.
+- **`.planning/debug/knowledge-base.md`** gains 2 new entries (Instance #4 + Instance #7 -- distinct patterns) so `gsd-debugger` surfaces these as known-pattern hypotheses on future investigations.
+- **`docs/install-cache-family-premortem.md`** appended with case #7 (the 7th case in the install-cache failure family -- two sub-cases shipped as one beta: bash-heredoc POSIX leak + silent activation gap). New sub-pattern documented (cross-platform fragility class beyond install-cache proper). Two new predicted failure modes added: **F. Cowork cross-tenant activation drift** (Class N assumes one active install per host); **G. Bash-heredoc POSIX leaks in non-`scripts/room-registry` sites** (deferred sweep targets logged).
+
+### User-facing note (Phase 127.2 Plan 04)
+- **If you previously ran `/mos:update` and `/mos:doctor --brain-smoke` still reports an older version, run `/mos:doctor --fix` once.** v1.13.0-beta.32 makes this automatic going forward. You will see a one-time "ACTIVATION GAP" red banner on next session-start if the touch-file from a prior update still flags a drift; the banner walks you through the two-step recovery.
+
+### Added (Phase 121.5 Sub-plan K -- Plan 121.5-10)
+- **Locked Brain-suggestion content template across all 5 consumers.** `/mos:suggest-next`, `/mos:act --chain`, the Phase 116 tension-hook-agent, the Phase 117 auto-explore-agent, and the Phase 89-07 reverse-salient-agent all render the same shape now: canonical `[■ BRAIN]` chip + verb-first question line + two-line dense option rows (glyph + verb + right-aligned confidence percent on top, framework category + graph relationship below) + stat-strip footer. The lock collapses 5 divergent renderings into ONE so the navigator's eye learns "Brain is speaking" in one session. Source: `.planning/121.5-selector-coverage-audit.md` Section 5.
+- **Promoted `/mos:suggest-next` from NONE (silent dispatch / plain-text list) to F.1** via `rankForSelector` + `pickShape` per audit Section 6 item 2. THE single highest-leverage promotion per the audit Executive Summary: every conversational "what next?" Larry reflex inherits the locked surface.
+- **Promoted `/mos:act --chain` `[GATE]` rendering from BESPOKE bracket text (`[continue]` / `[stop]`) to F.0 Mini Decision Gate** via `pickShape({ requestedShape: 'F.0' })` per audit Section 6 item 3. The closed F.0 vocabulary (Approve / Reject / Defer) replaces the bespoke two-button mental model without losing intent (Reject captures REJECTED_BECAUSE; Defer queues a milestone audit).
+- **Selector verb-label aliases (LOCKED decision 1).** Dispatcher carries `alias_map` (Resolve / Explore -> Run Methodology; Later -> Defer; Skip -> Free-Text) loaded once at module init from `lib/hmi/jtbd-taxonomy.json` `alias_map.verb_aliases`. Aliases render to the user; canonical verbs persist to graph edges via `navigation.cjs`. The render-vs-persist split honors both pedagogy (contextual aliases) and graph consistency (one stable vocabulary) without forcing one.
+- **CI tripwire `tests/test-no-bespoke-brain-prompts.sh`** enforces the lock (audit Section 6 item 6). Scans the 5 named Brain-suggestion consumer files plus any new source file that imports `chain-recommender.cjs` or `f-selector-ranker.cjs`; flags bracket-text option lists (`[continue]`/`[stop]`), verbose `(RECOMMENDED)` tags, and "Pick one to ..." selector-prompt prose. Wired into `tests/run-all-121.5.sh` SHELL_SUITES.
+- **`docs/F-SELECTOR-CONSUMER-GUIDE.md` Section 4 (NEW)** publishes the locked template (slot-value table + visual mockup + anti-patterns rejected + implementation wiring example) per audit Section 6 item 7. Makes the lock discoverable to future consumers before they invent a new pattern.
+- **`skills/ui-system/SKILL.md` Section 2** adds the Shape F.1 Brain-suggestion variant subsection (citing the locked chip + glyphs + footer + alias_map) AND a body_shape vs F-shape orthogonality note per LOCKED decision 4 (`body_shape:` is layout discipline; F-shape is the selector contract; they are orthogonal axes, not competing values).
+- **`lib/workflow/f-selector-ranker.cjs` MAX_K = 3 constant + clamp** per audit Section 5.2.3 anti-pattern ("More than 3 option rows pushes the AskUserQuestion auto-injected rows off-screen"). Caller asking k=20 silently receives k=3. New optional `category` + `graph_relationship` fields on returned items[] feed the locked template's two-line meta row.
+- **New tests:** `lib/memory/selector-alias-map.test.cjs` (24 assertions, alias_map round-trip + render-vs-persist invariant) + `lib/memory/brain-suggestion-template.test.cjs` (22 assertions, 5-consumer chip + footer isomorphism).
+
+### Deferred to v1.13.2 (LOCKED decision 3)
+- **CONTRADICTS-driven color flip (cyan -> yellow)** for Brain-suggestion selectors when any candidate carries a CONTRADICTS edge against an existing assumption. Yellow-on-cascade requires the consumer to walk the cascade graph BEFORE rendering (a SQL call on the rank path); we shipped cyan default in v1.13.0 to avoid that latency and queued the yellow-on-cascade signal as a v1.13.2 hotfix if testers report missed warnings. Ship simple, observe, then layer in if the data says it matters.
+
+### Deferred to v1.14.0 (LOCKED decision 5)
+- **F.1 close-out adoption on the 71 N/A methodology commands** (think-hats, structure-argument, grade, deep-grade, validate, etc.). Out of scope for Phase 121.5; the Phase 88.2 design legitimately delegates the methodology close to Larry's conversational follow-up. Phase 121.5 + 1 backlog. Scope discipline.
+
+## [1.13.0-beta.30] - 2026-05-23
+
+### Fixed (Engine 1 Act 1 silent-failure class, Phase 127.2 Plan 03 -- FIRST hotfix from external tester evidence)
+- **`scripts/doctor.cjs --check-rs-engine` pre-flight pre-flights Python deps for the Engine 1 Act 1 surface (Finding F1 -- `.planning/debug/resolved/windows-tester-find-bottlenecks-silent-failure-qa-sweep.md`).** ADD-ONLY flag handler (NOT a class flag; owns its own exit-code contract). Probes critical deps reachable from `scripts/rs-engine.py` -- `requests` (transitive via `lib/core/rs_corpus.py`, the actual silent-failure root cause on the Windows tester's machine) + `numpy` -- plus umbrella deps from `requirements-hsi.txt` (`sentence_transformers`, `sklearn`). Resolves python interpreter via `MINDRIAN_PYTHON` env override > `python3` > `python` fallback. On missing critical deps: exit 1 + actionable fix line `Run: pip install -r requirements-hsi.txt --user (use python -m pip if pip is not in PATH)`. JSON variant returns `{ ok, ready, python, probes[], missing, missing_critical, missing_umbrella, fix }`. Defensive: any uncaught probe error surfaces as exit 1 -- the probe never crashes `/mos:doctor`'s other gates. Closes the Windows tester 2026-05-23 silent-failure class for the pre-flight surface.
+- **`lib/agents/reverse-salient-agent.cjs` forwards rs-engine stderr to `result.detail.diagnostic` (Finding F2 -- same RCA).** The `runRsEngine()` catch block now captures `e.stderr` from the failed child python process, takes the LAST 200 chars (preserving the actionable fix line + exception name at the tail), and embeds it in `result.detail.diagnostic`. Backward compatible: when stderr is empty, `detail` stays a plain string (the existing `e.message` slice); when stderr is present, `detail` upgrades to `{ message, diagnostic }`. The existing `ok` / `reason` fields are untouched. Before this fix, every actionable error from rs-engine was silently discarded at the agent layer -- the worst-shape silent failure in a methodology surface.
+- **`commands/find-bottlenecks.md` empty-result UX disambiguates analyzer-down from no-findings (Finding F7 -- same RCA).** New "Empty-result UX" sub-section distinguishes two categorically different cases: (a) analyzer ran with no findings (plausible if room is small or genuinely balanced); (b) analyzer could not start -- detected via `result.detail.diagnostic` or `reason: rs_engine_invocation_failed`. The second path explicitly tells the user to run `/mos:doctor --check-rs-engine` with the pip-install one-liner inline. Before this fix, both cases rendered as "no findings" -- which reads as "your work is clean" regardless of whether the analyzer ran or crashed. The single most dangerous reading in a methodology surface.
+
+### Internal (Phase 127.2 Plan 03)
+- **New test:** `tests/test-127.2-03-rs-engine-silent-failure-fixes.sh` verifies all three findings landed (F1 flag-handler + actionable fix line embedded; F2 diagnostic-field reference + stderr-capture pattern; F7 disambiguation copy present in find-bottlenecks.md or agent file) plus a functional probe asserting `node scripts/doctor.cjs --check-rs-engine --json` returns valid JSON and `--help` documents the new flag. 7/7 PASS on origin/main.
+- **Phase 134 scaffolded as v1.14.0 architectural stub (Finding F6 -- structural answer to install-fragility class).** New `.planning/phases/134-cjs-port-of-python-analyzers-via-xenova-transformers-elimina/134-CONTEXT.md` captures the design vision: replace `scripts/rs-engine.py` + `lib/core/rs_*.py` + `scripts/hsi-*.py` with CJS equivalents using `@xenova/transformers` (ONNX `Xenova/multilingual-e5-large` in-process). Eliminates Python from user-machine surface entirely. Estimate ~3 weeks. Plan 127.2-03's original spec named "Phase 130" but slot 130 was already taken; SDK assigned 134 as next free slot. No PLAN.md (scaffolding only); enters v1.14.0 planning cycle.
+- **RCA closed and moved.** `.planning/debug/windows-tester-find-bottlenecks-silent-failure-qa-sweep.md` -> `.planning/debug/resolved/` with `resolved_by: phase-127.2 Plan 127.2-03 (hotfix; F1+F2+F7 shipped)` + `resolved_disposition: 3-of-4-fixed-in-code; F3 narrative drift deferred to next docs reconciliation; F6 architectural port scaffolded as Phase 134 stub`. Knowledge-base entry appended at `.planning/debug/knowledge-base.md` so `gsd-debugger` surfaces this as a known-pattern hypothesis on future investigations.
+- **Dog-fooding milestone:** the FIRST hotfix shaped from an EXTERNAL tester's transcript (Aryeh's Windows machine, 2026-05-23). Plans 127.2-00 + 127.2-02 were both maintainer-discovered. This one closes a defect a real user hit on a machine the maintainer doesn't own, and ships in the same week the transcript landed -- empirically demonstrating that the dog-fooding loop the QA sweep itself flagged as broken (RS-2 thesis: one-person QA is the lagging subsystem) is no longer one-person.
+
+
+
+## [1.13.0-beta.28] - 2026-05-23
+
+### Fixed (post-ship QA-sweep closeout, Phase 127.2 Plan 02)
+- **`scripts/doctor.cjs` `acceptance.version-of-record-published` now resolves the version-of-record from the LAST SHIPPED tag, not `plugin.json` (Finding B -- `.planning/debug/resolved/v1.13.0-beta.26-post-ship-qa-sweep.md`).** The gate previously read `plugin.json` and expected a matching git tag + marketplace `source.ref` + `npm view` for THAT version. But Commit B of the two-commit release form bumps `plugin.json` to the NEXT pre-release placeholder (e.g. `beta.27` while `main` HEAD is at the Commit B placeholder, even though the last shipped tag is `v1.13.0-beta.26`). The fix swaps the resolver to `git describe --tags --abbrev=0 --match='v*'` with a `plugin.json` fallback for fresh-repo edge cases. All three downstream assertions (tag exists, marketplace pinned, npm view matches) now key off the shipped tag. Same fix is mirrored into `acceptance.npx-roundtrip` at its `pluginVersion` derivation site for consistency.
+- **`scripts/doctor.cjs` `acceptance.npx-roundtrip` now treats "package downloaded and executed" as the success signal, not the inner `claude` CLI's exit code (Finding C -- same sweep doc).** The gate previously only accepted `r.status === 0` from `spawnSync`, but the published `@mindrian_os/install` script's inner `claude --version` invocation can exit non-zero on installer flag-schema drift (Claude Code release-channel skew) while the npm artifact itself is reachable and runnable. The gate now ALSO accepts `r.status === 0 OR /Installing the MindrianOS plugin|Adding marketplace|@mindrian_os\/install/.test(stdout+stderr)` -- the artifact's reachability is what the gate actually proves; `claude`'s flag schema is out of scope.
+
+### Changed (cross-repo, Phase 127.2 Plan 02 Finding A)
+- **`mindrian-website` (`website/src/lib/version.ts`) -- resolver priority swap: npm registry now wins over GitHub raw `plugin.json` in `getLatestVersion()`.** The website was rendering two `v1.13.0-beta.*` strings simultaneously because `fetchFromGitHub()` (which reads `plugin.json` on `origin/main` HEAD = the Commit B next-bump placeholder) ran BEFORE `fetchFromNpm()` (which reads what users can actually install via `npm @next`). After the swap, the live homepage returns a SINGLE version string = the last shipped beta. Lives in `/home/jsagi/mindrian-website/` (separate Vercel-deployed repo); pushed in lockstep with this plugin release.
+
+## [1.13.0-beta.26] - 2026-05-23
+
+### Fixed (Brain edge cleanups, Phase 127.2 Plan 00)
+- **`BRAIN_MAX_TOPK` cap on Pinecone forwards (D-09 -- `.planning/debug/resolved/brain-topk-uncapped-advisory.md`).** The Brain MCP server (`mcp-server-brain/lib/brain-ask.cjs` line 545 + `mcp-server-brain/lib/pinecone-tools.cjs` line 42) forwarded caller-supplied `topK` directly to Pinecone with no Brain-side cap. The moat against runaway result sets was INHERITED from Pinecone's server-side cap, not OWNED by the Brain. A new `BRAIN_MAX_TOPK` env var (default 100) is now applied via `Math.min(topK, BRAIN_MAX_TOPK)` at both forward sites. Naming matches the existing `BRAIN_CYPHER_MAX_ROWS` family from Phase 127.1 Plan 05's D-MOAT-2 work. Server-side change deploys to `mindrian-brain.onrender.com` on next Render auto-deploy from `origin/main`. Surfaced by the Windows beta-tester deep audit (2026-05-23, NF-2026-05-23-01b).
+
+### Documentation (Phase 127.2 Plan 00)
+- **Source-of-Truth Preamble shipped in `docs/RCA-TEMPLATE.md` (D-10 -- `.planning/debug/resolved/stale-install-cache-audit-anti-pattern.md`).** Every QA / audit prompt and every RCA filing now MUST declare which source-of-truth its CODE claims read against (origin/main HEAD, install cache, branch, tag), which source-of-truth its WIRE claims probe against (deployed Brain server, local stdio shim, mock), the date of audit, and a re-verification rule against `origin/main` HEAD before findings are filed. The 2026-05-23 deep audit surfaced TWO false-positive findings (NF-2026-05-23-01 + the curated-op-surface-missing claim) plus one sibling (`brain-ask-contract-mismatch-rename`) that all traced to the same install-cache-vs-deployed-server delta. The Preamble does not prevent the delta -- it makes the delta VISIBLE so reconciliation happens BEFORE findings are filed. Added checklist row: `- [ ] Source-of-Truth Preamble filled before any finding filed`.
+
+### Resolved (no code change required)
+- **`brain-ask-contract-mismatch-rename` disposition: false-positive (D-08).** The Windows beta-tester flagged `brain_ask`'s tool description as misleading (reads "ask anything in natural language" but actually returns a DirectiveEnvelope routing payload). Re-read of `origin/main` HEAD at resolution showed the description was ALREADY rewritten to name "Returns a DirectiveEnvelope payload (populated directive + next_gate + mode_signals)" verbatim. The auditor read from a stale install cache (plugin v1.13.0-beta.24 or earlier) that pre-dated the description rewrite. No code change shipped. Resolution doc: `.planning/debug/resolved/brain-ask-contract-mismatch-rename.md`. This is the meta-finding that motivated D-10's Source-of-Truth Preamble.
+
+### Internal
+- **Phase 127.2 scaffolded (CONTEXT + Plan 00 + Plan 01 stubs).** New phase `127.2-brain-warmup-ping-hide-mcp-cold-start-latency-inside-larry-s/` registered in ROADMAP (INSERTED + URGENT marker). Plan 127.2-00 (Brain Edge Bundle: D-08 + D-09 + D-10 + 3 debug-doc closeouts) ships in this beta. Plan 127.2-01 (the warmup-ping itself: `brain_ask("warmup")` fired non-blocking inside Larry's first-question render window to hide MCP cold-start latency) stays BLOCKED on two cross-phase coordination items: Q-02 (Phase 114 render-complete callback) and Q-03 (Brain server-side "warmup" sentinel short-circuit). Plan 127.2-01 rides a later beta once blockers close.
+- **3 debug docs moved to `.planning/debug/resolved/`** with `resolved_by: phase-127.2` frontmatter + Resolution sections + `.planning/debug/knowledge-base.md` summary entries (so `gsd-debugger` surfaces them as known-pattern hypotheses in future investigations).
+- **New test:** `tests/test-127.2-00-brain-edge-bundle.sh` verifies all three landed (D-08 description, D-09 cap at both forward sites, D-10 Preamble + checklist row, debug-doc moves, knowledge-base entries, Canon Part 8 forbidden-substring scan on D-09 added code). 16/16 pass.
+
+## [1.13.0-beta.24] - 2026-05-22
+
+### Fixed
+- **Brain unreachable on the first session after a plugin update -- now fixed on all three platforms.** `claude plugin update` lands a fresh plugin cache directory with no `node_modules`. Both bundled MCP servers (`mindrian-brain` + `mindrian-os`, both `alwaysLoad`) then crashed at module load (`Cannot find module '@modelcontextprotocol/sdk/server/mcp.js'`), the Brain was unreachable, and `/reload-plugins` reported a load error. On Windows the gap was *permanent* -- the repair never ran (see the portable self-heal note below). Root cause: a startup-order race plus a cross-platform defect in the repair (debug session `mcp-servers-cache-missing-node-modules`). The fix below makes Brain connectivity true by construction on Windows, Mac, and Linux.
+
+### Changed
+- **Vendored production dependencies (the guarantee).** The plugin now ships its production `node_modules` with the released marketplace artifact, so the Brain shim's dependencies are present the instant the install cache lands -- no runtime install, no network, no startup race. Every production dependency was audited and confirmed pure-JavaScript (zero native/compiled binaries: no `.node` addons, no `binding.gyp`, no prebuilt platform binaries, no install lifecycle scripts), so the same vendored tree is correct on Windows, Mac, and Linux by construction. The vendored tree is built fresh from `package-lock.json` via `npm ci --omit=dev` during the release (`scripts/release.sh` Step 6.7), staged onto the tagged release commit only -- `main` HEAD stays clean. This is a new release lockstep surface (see `.claude/includes/release-process.md`); it can never drift from the lockfile.
+- **Portable cross-platform self-heal (the backstop).** The runtime self-heal that repairs an incomplete cache is now cross-platform. The prior implementation ran a bare `spawnSync('npm', ...)`, which was *dead on Windows* (`npm` is `npm.cmd`, a batch file -- bare `spawnSync` returns `ENOENT`) and *fragile on Mac* (a GUI-launched Claude Code gives child processes a minimal `PATH` that often excludes the nvm / Homebrew bin directory where `npm` lives). The new `lib/core/npm-cli-resolve.cjs` resolves `npm` to its absolute `npm-cli.js` entry point off `process.execPath` -- npm ships in the same distribution as the running `node` binary -- and runs it as `node <abs npm-cli.js> install`. This sidesteps `PATH`, the `.cmd` extension, and `shell:true` entirely. Applied to both spawn sites (`lib/core/mcp-dep-heal.cjs` and `scripts/sessionstart-npm-reconcile.cjs`).
+- **Hybrid self-heal for the plugin cache (carried from the prior staging of this beta).** The vendored tree is the primary guarantee; the self-heal is the backstop for a somehow-incomplete cache. Three coordinated changes still close the race from both ends:
+  1. The `sessionstart-npm-reconcile.cjs` hook is `async: false` and ordered FIRST in the `SessionStart` chain, so any needed dependency install completes before Claude Code reads `.mcp.json` and spawns the MCP servers.
+  2. Both MCP entry points (`bin/mindrian-brain-mcp-client.cjs`, `bin/mindrian-mcp-server.cjs`) self-heal: a missing dependency triggers a one-shot guarded `npm install` in the plugin cache root, then re-requires. On a normal install (vendored deps present) this is a cheap `stat()` pre-flight that spawns nothing.
+  3. A lockfile guard (`lib/core/npm-install-lock.cjs`) ensures that when both servers spawn together, exactly one runs `npm install` while the other blocks and waits -- two concurrent installs can never corrupt `node_modules`.
+- New modules: `lib/core/mcp-dep-heal.cjs` (`ensureDepsPresent` + `requireWithHeal`) and `lib/core/npm-cli-resolve.cjs` (portable npm resolution). Zero network surface -- pure node built-ins plus a single guarded `npm install` child process (Canon Part 8). Mirrors the existing reconcile-hook detection logic rather than inventing a new mechanism (Canon Part 7).
+- `package-lock.json` resynced with `package.json` (it was 13 betas stale; `npm ci` could not run against it). No runtime dependency versions changed -- a metadata-only catch-up.
+
+### Fixed (dependency hygiene, surfaced by the vendoring audit)
+- **`/mos:doctor` would crash with `Cannot find module 'semver'` on a production-only install.** `scripts/doctor.cjs` -- a user-facing runtime script invoked by `/mos:doctor` -- requires `semver` for version-ordering (`semver.compare`), but `semver` was declared as a `devDependency`. A full audit of every `require()` of a declared dependency across all shipped code paths confirmed `semver` was the only misclassification. Moved to `dependencies` so it is present on every install (and in the vendored tree). `devDependencies` is now empty.
+
+### Fixed (lockfile + probe correctness, surfaced by a remote code review of the self-heal backstop)
+- **Concurrent-install corruption from a non-atomic lock (`bug_004`).** `lib/core/npm-install-lock.cjs` created its lock with `openSync('wx')` and then populated it with a *separate* `writeSync`. The create is atomic, but the file existed empty between the two syscalls -- a racing peer that hit `EEXIST` then read the empty file, `JSON.parse('')` threw, the lock was misclassified as corrupt, the winner's live lock was unlinked, and both servers ran `npm install` at once. Lock creation is now atomic via `fs.linkSync` (the payload is written to a private temp file in full, then atomically linked into place), so a winner's lock is always observed fully-written. As defence-in-depth `readLock` now distinguishes a transient empty mid-write file (sentinel `'EMPTY'` -- caller retries) from genuinely corrupt non-empty JSON (`null` -- safe to clear), and both `acquireInstallLock` and `waitForUnlock` treat an empty file as transient instead of as a cleared/dead lock.
+- **False-stale reclaim of a healthy long install (`bug_001`).** The lock's `STALE_THRESHOLD_MS` was 90s, but `runGuardedInstall` gives `npm install` a 120s timeout -- a healthy install legitimately running 90-120s was declared abandoned, and because the staleness check used OR (`age > STALE || !pidAlive`) a peer reclaimed the *live* lock and started a second concurrent install. The threshold is raised to 180s (strictly above the 120s install timeout, 60s headroom) and the staleness check is now an AND-gate: a lock is reclaimed only when it is BOTH older than the threshold AND its owning pid is dead. `WAIT_TIMEOUT_MS` raised to 200s to stay above the new stale threshold.
+- **Dependency probe too narrow (`bug_011`).** `ensureDepsPresent` probed only `['@modelcontextprotocol/sdk', 'zod']`. A partially-populated `node_modules` (those two present, `@modelcontextprotocol/ext-apps` or another production dep absent) passed the probe, no heal ran, and a bare `require` deeper in the `lib/mcp/*` chain then threw `MODULE_NOT_FOUND` at module-init scope and crashed the server. The probe now defaults to the FULL production dependency set read from the plugin's `package.json` (`Object.keys(pkg.dependencies)`), matching what `scripts/sessionstart-npm-reconcile.cjs` already does; a missing or unreadable `package.json` falls back to the MCP-critical pair rather than crashing. New regression suites: `lib/core/npm-install-lock.test.cjs` (18 tests) and `lib/core/mcp-dep-heal.test.cjs` (9 tests).
+
+## [1.13.0-beta.22] - 2026-05-21
+
+### Documentation
+- **Brain-query moat guard recorded (Phase 127.1 Plan 05).** The moat-guard code shipped inside the v1.13.0-beta.21 tag but beta.21's changelog never recorded it. Backfilled here: on the `mcp-server-brain` Brain server, `brain_query` is now gated to the `admin` plan (D-MOAT-1), and four Cypher execution safeguards ported from the official Neo4j `mcp-neo4j-cypher` recipe bound every read the gate permits (EXPLAIN estimated-row reject, row cap, byte cap, read timeout; D-MOAT-2). The Brain's Neo4j was confirmed on the Aura Free tier (D-MOAT-4); a scoped `neo4j_reader` credential (D-MOAT-3) is deferred because Aura Free has no role-based access control. `mcp-server-brain/CLAUDE.md` carries the full "Brain-query moat guard" section. This is a Brain-server change, not shipped-plugin code; no plugin behavior changes in this beta.
+
+### Internal
+- **Phase 128.1 (session isolation) parked on branch `phase-128.1`.** Phase 128.1 is a v1.13.1 milestone phase. It was pulled off the v1.13.0 release line so the line stays clean; `main` carries zero 128.1 code. 128.1 is complete on its branch (6 of 6 plans) and ships in the v1.13.1-beta.3 band with phases 128 and 129.
+
+## [1.13.0-beta.21] - 2026-05-20
+
+### Added
+- (next-pre-release Commit B placeholder; Phase 127 Brain MCP Local Stdio Shim work ships here per `.planning/v1.13.1-EXECUTION-PLAN.md` AMENDMENT 2026-05-19)
+
+## [1.13.0-beta.19] - 2026-05-19
+
+### Promoted (2026-05-19 -- v1.13.0 milestone redefinition)
+- **Phase 127 (Brain MCP Local Stdio Shim + Auto-Migration) and Phase 127.1 (Brain GraphRAG Collapse Pinecone -> Neo4j HNSW) PROMOTED from v1.13.1 INTO v1.13.0.** v1.13.0 milestone redefined from "The Closed Loop" (Hooked Fixes + Canon Part 10) to **"The Closed Loop + Brain Goes Native"**. Phase 127 targets v1.13.0-beta.20 (client-side stdio shim, ~3-5 days; Tavily-validated 2026-05-19); Phase 127.1 targets v1.13.0-beta.21 (server-side Neo4j HNSW collapse, ~3-5 days + 20-query non-regression harness >= 80% top-5 overlap). v1.13.0 final cuts after both land. Trade-off: ~2-week ship-date slip, but ONE adoption cycle for "Brain feels native end-to-end" instead of two. v1.13.1 milestone keeps Phases 128/129/130/131 but loses its architectural anchor (renaming pending: "spine repair + lens engine + research workflow", not "Brain native"). External validation in flight via Tavily research agent before /gsd:plan-phase 127 fires. See ROADMAP.md Phase 127 + 127.1 sections, both CONTEXT.md files (frontmatter `milestone:` flipped 2026-05-19), and .planning/v1.13.1-EXECUTION-PLAN.md AMENDMENT block.
+
+### Added (2026-05-17 -- 2026-05-19 endgame work bundled into this beta)
+- **Phase 120 (Breakthrough Scan Category G) shipped 2026-05-17.** 9-of-9 must-haves verified. Hooked Fix 3 (Category G) closed: variable-reward axis ships the highest-nutrition flavor (own-breakthroughs surfaced back at the navigator). 4 detectors (convergence / contradiction-resolved / cross-domain analogy / reverse-salient closed) + F.7 Breakthrough Surface selector (5 verbs: Explore deeper / Confirm / File as decision / Dismiss / Back) + session-start scanner via Phase 109 navigation.cjs chokepoint + D-13..D-15 resurfacing rules + D-19 per-detector dismissal-rate canary + D-17 4-rule voice scaffold + D-18 4-tier ethics fence (HARD_FLOOR / SOFT_BAND / NEUTRAL / GREEN) + SOFT_BAND review queue in rooms-meta.db + 5-component scoring formula + "More breakthroughs (N)" affordance + D-20 LOAD-BEARING SQL invariant (every Breakthrough has a DERIVED_FROM edge by construction; 4 structural enforcement points). 159 unit tests + 4 D-20 e2e + 13 ethics-fence + voice-audit + 3 scaffold harnesses all green. Canon Part 4 cascade vocab honored (8 types; 2026-05-16 dual-graph review rejection sealed -- no ASSOCIATION_LENS / TRANSITION_LENS). Canon Part 8 clean. Canon Part 9 chokepoint preserved (10 modules route through navigation.cjs).
+- **Phase 121 (Trajectory Telemetry) shipped 2026-05-19.** 12-of-12 must-haves verified. Reframed per Canon Part 7 from "greenfield instrumentation" to "consolidation": 4 piecemeal telemetry writers (`mva.jsonl` + `selector.jsonl` + `navigation-bypass.jsonl` + `query-efficiency.jsonl`) collapse to ONE unified `~/.mindrian/telemetry/v1.13/events-YYYY-WNN.jsonl` with `type` discriminator + frozen v1 schema (per-row `schema_version: 1` Number, 15 EVENT_TYPES) + ISO-week rotation + single emit-time-validator chokepoint (7 forbidden-pattern detectors, mirrors proven `mva-telemetry.cjs` shape) + idempotent migration (source-name-prefixed sha256 fingerprint, originals renamed `*.pre-v121.bak`) + `mva-telemetry.cjs` 170 -> 58-line shim delegating to writer with legacy dual-write (Phase 118 byte-functional compat preserved; dual-write retires v1.14.0). 9 capture points wired: selector picks (88.2 + 125), tension engagement (116), auto-explore decisions (117), breakthrough dismissed (120), MVA + Hooked re-score (inherited), empathy audit CLI, room-receipt (119), PostToolUse broad-sweep into separate `command_invocation` bucket (drowning-protected via type discriminator; 100 cmd_inv + 10 selector_pick fixture proves filter-isolation). `docs/TELEMETRY-SCHEMA.md` (364 LOC) frozen v1 spec + SEED-002 ingestion guidance (arXiv 2508.03680). Canon Part 8 adversarial audit (7 gates across 17 telemetry-touching files; zero LOCAL->BRAIN egress) + D-12 silent-observability invariant (4 gates). 19/19 test suites green.
+- **Phase 121.5 re-verify fix 2026-05-19.** `/mos:dogfood-flush` (added by Phase 120) registered in `data/help-groups.json` Infrastructure group. Restores 3 previously-failing 121.5 coherence tests. Capstone coherence invariant holds against the now-complete v1.13.0 surface. `bash tests/run-all-121.5.sh` -> 11/11 suites green.
+- **SEED-011 (Brain Silent Identity) filed 2026-05-19.** Deferred user request to eliminate the API-key step entirely on top of Phase 127's stdio shim. Three architectural options scoped (per-install silent registration / plugin attestation HMAC / anonymous tier + degraded payload). NOTE: this seed was originally filed under id SEED-003 (collided with the 2026-05-05 `SEED-003-claude-code-2-1-x-capability-adoption`); renamed to SEED-011 on 2026-05-24 during the seed-system curation pass per `.planning/seeds/INDEX.md` collision-resolution rule (chronologically-earlier + downstream-heavier seed keeps id 003).
+
+### Added
+- **`/mos:mos` state-aware router (Phase 121.5-08 Sub-plan J; D-10 LOCKED).** Closes the plugin.json declaration gap flagged in Cluster 5 audit 2026-05-15 (the command was declared but the backing file was absent). The router picks the right next surface for the navigator: no room -> `/mos:onboard`; mostly-empty room -> `/mos:status` with a "suggest next move" hint; populated room -> `/mos:suggest-next`. Backed by `lib/core/state-aware-router.cjs` (pure function, hermetic unit tests in `lib/memory/state-aware-router.test.cjs`). Meets the navigator where they are -- one entrypoint that always does the right thing rather than forcing the user to pick the right `/mos:*` surface. (`commands/mos.md` [new], `lib/core/state-aware-router.cjs` [new], `lib/memory/state-aware-router.test.cjs` [new].)
+- **Soft-alias runner + 5 soft-alias stubs (Phase 121.5-08 Sub-plan J; D-09 LOCKED).** New helper `scripts/soft-alias-runner.cjs` (`softAliasRun` pure function + `emitForLLM` CLI form) returns a JSON envelope `{redirect, deprecation_note, args, ok}` so the LLM can print a single cyan deprecation line (Larry voice, no em-dash) and then transparently invoke the canonical command. Hermetic unit tests in `lib/memory/soft-alias.test.cjs` (45 PASS). (`scripts/soft-alias-runner.cjs` [new], `lib/memory/soft-alias.test.cjs` [new].)
+- **`/mos:doctor --deprecated-usage` (class L, NEW; Phase 121.5-08 Sub-plan J; D-09 final clause).** Scans recent (last-7-days) `~/.claude/projects/.../*.jsonl` session transcripts for `/mos:<deprecated>` patterns and surfaces a per-command "use `/mos:<new>` instead" hint. Pure LOCAL scan -- zero network, zero Brain, zero telemetry egress (Canon Part 8 preserved). Also activated by `--all`. Hermetic unit tests in `lib/memory/doctor-deprecation-surface.test.cjs`. `MINDRIAN_DOCTOR_TRANSCRIPTS_DIR` env-var override for hermetic tests. (`scripts/doctor.cjs`, `commands/doctor.md`, `lib/memory/doctor-deprecation-surface.test.cjs` [new].)
+- **F.1 Next Move selectors wired on `/mos:onboard` Step 6 + `/mos:diagnose` recommendation block (Phase 121.5-08 Sub-plan J; D-12 LOCKED).** Closes Canon Part 3 violations flagged in Cluster 5 audit 2026-05-15: the recommendation surfaces previously rendered as bare prose, bypassing the Decision Gate. Both surfaces now render the canonical 3-verb F.1 vocabulary (Run Methodology / Defer / Free-Text) via AskUserQuestion; the selected verb writes to STATE.md Decisions + creates a typed edge in the local graph. (`commands/onboard.md`, `commands/diagnose.md`.)
+
+### Changed
+- **5 commands deprecate to canonical surfaces (Phase 121.5-08 Sub-plan J; D-09 LOCKED).** All old commands remain functional for v1.13.x (soft-alias stubs with deprecation notes routed through `scripts/soft-alias-runner.cjs`); removal is scheduled v1.14.0. Zero tester breakage during v1.13.x:
+  - `/mos:heal` -> `/mos:doctor --heal-room` (folds into doctor's class E fix engine)
+  - `/mos:query` -> `/mos:graph "<question>"` (terminal natural-language Q&A collapses into the graph translator)
+  - `/mos:organize` -> `/mos:rooms organize <verb>` (portfolio grouping folds under the multi-room surface)
+  - `/mos:hmi-status` -> `/mos:doctor --ui-compliance --json` (D-11 LOCKED; standalone command goes away; functionality lives in doctor class F)
+  - `/mos:visualize` -> `/mos:dashboard --mermaid` (the dashboard already renders Cytoscape; the `--mermaid` flag covers the Mermaid code-block fallback that visualize used to provide)
+- **`/mos:diagnostics` is being renamed to `/mos:fingerprint` in v1.14.0 (no functional change).** The rename kills the diagnose/diagnostics naming ambiguity. Both invocations work in v1.13.x; use `/mos:fingerprint` going forward. (`commands/diagnostics.md` frontmatter `renaming_to: fingerprint`; body prepends a Renamed note before the unchanged 4-algorithm dispatcher.)
+
+## [1.13.0-beta.17] - 2026-05-15
+
+### Fixed
+- **Step 6.6 ordering hole (Bug 1 -- Phase 126.1 hotfix, 2026-05-15).** Phase 126 beta.16 hotfix `3fc008b` moved `verify-release-clean-tree` from `applies_to: ['pre-tag', 'full']` to `['full']` because `release.sh` Step 6.6 calls `--pre-tag` AFTER Steps 3-6 intentionally bump `plugin.json` + `package.json` + `CHANGELOG.md`. That made the cut sail through, but the strict clean-tree gate no longer ran pre-tag AND Test 2 of `tests/test-doctor-acceptance-preflight-checks.cjs` was converted to SKIP rather than re-pointed. Real gap, predicted by `docs/install-cache-family-premortem.md` Section 3. Fix (Option B): added a new `pre-flight` tier to the `applies_to` enum (strict subset of `pre-tag` minus in-flight-incompatible checks); added the `--pre-flight` CLI flag to `scripts/doctor.cjs`; added Step 2.5 to `scripts/release.sh` calling `doctor --acceptance --pre-flight` BEFORE Step 3 mutates the tree (HARD ABORT, no rollback needed because nothing is yet mutated); kept the existing Step 6.6 `--pre-tag` call after Step 6 (still the right tier for post-bump checks). Restored Test 2 from SKIP to PASS under the new tier; added Test 8 asserting tier filter behavior. (`scripts/doctor.cjs`, `scripts/release.sh`, `tests/test-doctor-acceptance-preflight-checks.cjs`.)
+- **Commit B 7-place lockstep gap (Bug 2 -- Phase 126.1 hotfix, 2026-05-15).** `scripts/release.sh` Step 7.5 (Commit B, the next-pre-release advance) bumped `plugin.json` + `package.json` to `NEXT_VERSION` but left `~/mindrian-marketplace/.claude-plugin/marketplace.json` at `vN`. Per `feedback_install_minisite_lockstep.md`, the 7-place lockstep contract requires the marketplace.json `version` field to advance with the plugin repo. The bug recurred in beta.16. Fix: Step 7.5 now writes a second `node -e` block that bumps `MARKETPLACE_DIR/.claude-plugin/marketplace.json` to `NEXT_VERSION` (version field only -- `source.ref` deliberately stays at `vNEW_VERSION` pinning the marketplace commit at Commit A's tag); parallel marketplace-repo `git commit` follows with message `chore: bump marketplace.json to v$NEXT_VERSION (Commit B 7-place lockstep)`. Test H asserts the bump pattern is present in `scripts/release.sh`. (`scripts/release.sh`, `tests/test-release-bump-algebra.cjs`.)
+- **Step 9.7 npx-publish self-test sandbox bug (Bug 3 -- Phase 126.1 hotfix, 2026-05-15).** `scripts/release.sh` Step 9.7 ran `npx --yes @mindrian_os/install@<version>` from an `mktemp -d` temp dir and checked the dir was non-empty after install -- but `@mindrian_os/install` installs into `~/.claude/` (the Claude Code plugin install root), NOT into cwd, so the temp-dir check spuriously failed during the beta.16 cut. Fix (Option A): switched to a HOME-override sandbox at `~/.claude/_test-install-<sha8>/` (subpath under `~/.claude/` per scope; mirrors the Phase 123 `doctor.cjs:2336` sandbox pattern). The npx run sets `HOME=$NPX_TEST_DIR` + `USERPROFILE=$NPX_TEST_DIR` + `npm_config_cache=$NPX_TEST_DIR/.npm` so the install resolves into the sandbox subpath, never touching the operator's real `~/.claude/`. Scaffold marker check now asserts `$NPX_TEST_DIR/.claude/plugins/installed_plugins.json` exists AND is parseable JSON. `trap` cleanup guarantees the sandbox dir + the pre-snapshot file are removed even on abort. Option B (extend `~/mindrianos-install-site` npm-installer with a `--target=<dir>` flag) is the cleaner long-term fix but out of scope for this hotfix (separate repo). Test I asserts the sandbox path + HOME-override are present in `scripts/release.sh` and the legacy `mktemp -d -t mos-npx-selftest` pattern is gone. (`scripts/release.sh`, `tests/test-release-bump-algebra.cjs`.)
+
+### Changed
+- **Phase 122 `teaching:` frontmatter on `/mos:mva-brief` + `/mos:mva-option` verified clean (Phase 126.1 hotfix audit, 2026-05-15).** Per `118/deferred-items.md` lines 5-20 the two MVA helper commands lacked `teaching:` strings as of Plan 118-06. Inspection found the strings were already added between then and now (`commands/mva-brief.md` line 6: 200 chars; `commands/mva-option.md` line 6: 180 chars). All four Phase 122 invariants verified: length 50-300 chars (200 + 180), zero em-dashes (`grep -nP "[—–]"` empty), 1-2 sentences each (terminal `.`), Larry-voice with WHY lede. `node scripts/build-command-registry.cjs --check` exits 0. No edits required; verification-only commit. The pre-existing `118/deferred-items.md` "Pre-existing build-command-registry teaching-field gap" entry can be marked RESOLVED in a follow-up. (`commands/mva-brief.md`, `commands/mva-option.md`.)
+
+## [1.13.0-beta.16] - 2026-05-14
+
+### Added
+- 
+
+## [1.13.0-beta.14] - 2026-05-14
+
+### Added
+- 
+
 # Changelog
 
 All notable changes to MindrianOS Plugin will be documented in this file.
@@ -9,13 +275,82 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 <!-- When onboarding: true, the onboard_steps list is shown to returning users in the What's New flow -->
 <!-- This allows new releases to automatically surface relevant guidance without code changes -->
 
-## [Unreleased] -- v1.13.0-beta.10 (in progress)
+## [1.13.0-beta.13] - 2026-05-13
+
+### Added
+
+- **Install-state contract (Phase 123 Plans 02 + 03 -- HARNESS-123-05..10).** **One record** is the truth (`~/.mindrian/install-state.json`, written by `scripts/session-start` as the single writer in earliest steps; full D-04 snapshot incl. the 4 version-of-record cross-check values). **One manifest** says what should be on disk (`data/deployment-surfaces.json`, 6 hand-maintained surfaces with the D-07 schema -- id / `$HOME`-tokenized path / owner / topology_scope / check_kind / expected / reconcile / remediation; reused `data/` layout convention from Phase 122). **One command** enforces the contract: `mindrian-os doctor` gains two new drift classes -- **class I** (install-state record present + internally consistent + topology classification + 6-way version-of-record consistency tolerating non-semver 4-component versions like `1.12.5.1` via string-equality) + **class J** (deployment-surface manifest reconciliation with `path_within_file` extraction for JSON sub-fields like `settings.json.statusLine.command`) -- under one new flag `--install-state`; `--all` activates both. **Bug 7 dies**: a marketplace-cache-only install is a *healthy* topology, not drift -- "no legacy clone dir on a marketplace box" is expected, not a finding. Aggressive `doctor --fix` with hard guardrails (D-13): auto-recover missing record + drifted owned surfaces + wrong `~/.mindrian-last-version`; legacy-clone migration is backup-then-verify-then-remove and REFUSES on a dev-clone, uncommitted/unpushed work, or `MINDRIAN_OS_ROOT` pointing at the legacy dir; conservative `installed_plugins.json` repair (repoint at newest valid marketplace-cache dir, never wholesale rewrite, always back up first); 3 flag-only cases (`topology: not-found`, `$PATH` entry vanished, statusline-renders-wrong-version) reported with explicit remediation strings. `lib/core/active-plugin-root.cjs` extended with a `topology` field exposing `marketplace-cache | dev-clone | legacy | not-found`. Hermetic Wave-0 fixtures: `tests/test-install-state-record.cjs` (6/6) + `tests/test-doctor-class-i.cjs` (11/11) + `tests/test-doctor-class-j.cjs` (8/8) all green. (`scripts/session-start`, `lib/core/active-plugin-root.cjs`, `data/deployment-surfaces.json` [new], `data/ROOM.md`, `scripts/doctor.cjs`, `tests/test-install-state-record.cjs` [new], `tests/test-doctor-class-i.cjs` [new], `tests/test-doctor-class-j.cjs` [new], `lib/memory/run-feynman-tests.cjs`.)
+
+- **`mindrian-os doctor --acceptance` release-gate command (Phase 123 Plan-04 -- HARNESS-123-11 + HARNESS-123-12).** Seven-point contract: (1) install-state record present + matches a live spot-check; (2) every owned deployment surface reconciled; (3) version-of-record consistent across `plugin.json` / `package.json` / CHANGELOG top entry / git tag / marketplace `source.ref` / published npm version; (4) `npx @mindrian_os/install` round-trip works (`mktemp -d`-backed `HOME`-sandbox -- the live install is never clobbered; `--light-npx` flag for slow networks asserts `npm view ... && npx ... --help` instead); (5) `doctor --all` exits 0. Two sub-modes: `--pre-tag` runs the 5 points knowable BEFORE the release (1, 2, 3-repo-half, 4-wrap-via-verify-release, 5); full `--acceptance` adds the 2 post-publish points (version-of-record-published + npx round-trip). Wraps `scripts/verify-release` -- no duplication. Wired into `scripts/release.sh` at Step 6.6 (`--pre-tag` before the tag) and Step 9.6 (full after the push); both HARD aborts, no override. Orchestration is node, shell-agnostic. "Release infrastructure ALWAYS ships as a beta validated by an external operator" now *means* "the operator ran `mindrian-os doctor --acceptance`, all green" -- not "the operator eyeballed the statusline." Hermetic Wave-0 test `tests/test-doctor-acceptance.cjs` (6/6) green. (`scripts/doctor.cjs`, `scripts/release.sh`, `tests/test-doctor-acceptance.cjs` [new], `scripts/release-beta-smoke.sh` [deleted].)
+
+- **`scripts/release.sh` owns ALL version bumps incl. pre-releases (Phase 123 Plan-01 -- HARNESS-123-01..04).** Pre-release algebra via the `semver` npm package added as a **devDependency** (NOT a runtime dep -- stays out of the `files` allowlist; the published `@mindrian_os/install` tarball is still zero-runtime-dep). New flags: `--prerelease` (`beta.N -> beta.N+1` via `semver.inc(v, 'prerelease', 'beta')`); `--finalize` (promote a beta to its core via `semver.inc(v, 'patch')` -- which *strips* the suffix, so `1.13.0-beta.11 -> 1.13.0`, NOT `1.13.1`); `--start-prerelease <core> <channel>` (open a fresh series via `semver.inc(v, 'preminor', 'beta')`); `--allow-ahead` (escape hatch for the dirty-repo guard). **TWO-COMMIT next-bump form** (per RESEARCH override 1 -- verified against Claude Code's Version Management spec; `plugin.json` wins over the marketplace entry for installed-version reporting): commit A finalizes `CHANGELOG [vN]`, sets `plugin.json` + `package.json` to `vN`, the `vN` git tag points at commit A; commit B bumps to `vN+1` + resets the CHANGELOG `[Unreleased] -- vN+1` heading; `main` HEAD lands on commit B. `marketplace.json` `version` + `source.ref` pin to `vN` -- so an install via `ref: vN` checks out commit A and self-reports `vN`. **Dirty-repo / ahead-of-origin guard**: before pushing, `release.sh` snapshots `git log origin/main..HEAD --oneline`, prints it, aborts unless the only commits ahead are the release commits it just made (or `--allow-ahead` set); blocks on dirty tracked files except the bumped ones; no author heuristics. **Step 9.5 renamed** `@mindrian_os/cli` -> `@mindrian_os/install` (publish target + `next`/`latest` dist-tag derivation + `npm pack --dry-run` payload-allowlist gate + recovery instructions). Hermetic Wave-0 test `tests/test-release-bump-algebra.cjs` (7/7) green; `tests/test-release-npm-gate.sh` updated to the `@mindrian_os/install` expectations (6/6 gates green). beta.13 is the first `release.sh`-cut pre-release after the run of hand-rolled beta.10 / 11 / 12. (`scripts/release.sh`, `package.json`, `tests/test-release-bump-algebra.cjs` [new], `tests/test-release-npm-gate.sh`.)
 
-beta.10 is the v1.13.0 CAPSTONE -- its headline content is the **Workflow Layer** (framework <-> command registry + reliable invocation; spec at `.planning/WORKFLOW-LAYER-SPEC.md`), not yet built. The items below are what has landed on `main` toward beta.10 so far; the entry will be finalized (dated, full feature list) when the Workflow Layer ships.
+- **Cache pruning on update (Phase 123 Plan-05 -- HARNESS-123-13).** `lib/core/cache-prune.cjs` keeps the active version + N=2 most recent `<pluginsDir>/cache/<marketplace>/mos/<version>/` dirs; NEVER deletes the active (belt-and-suspenders -- the active is unconditionally in the keep-set regardless of mtime); skips entirely if `installed_plugins.json` is missing, unparseable, or has no `mos@mindrian-marketplace` entry. Runs in `scripts/session-start` on version change (best-effort, `|| true`) AND in `scripts/doctor.cjs::performClassJFix` unconditionally on `--fix`. Hermetic Wave-0 test `tests/test-cache-prune.cjs` (6/6) green. (`lib/core/cache-prune.cjs` [new], `scripts/session-start`, `scripts/doctor.cjs`, `tests/test-cache-prune.cjs` [new].)
+
+- **Phase 123 Plan-07 -- single Brain-key resolver + positive session-start status (HARNESS-123-15 + HARNESS-123-16).** Three independent Brain-key lookups (`brain-client.cjs::getApiKey`, `scripts/session-start`'s shell test of `MINDRIAN_BRAIN_KEY`, the `brain-connector` skill's detection order) are collapsed into one source of truth, `lib/core/resolve-brain-key.cjs`. The resolver mirrors `lib/core/active-plugin-root.cjs`'s shape (`{ key, source, available, reason }`) and order (env -> `~/.mindrian.env` -> CWD `.env` -> not-found, the D-31 precedence); SEC-02 POSIX `0o077` permission rejection routes through an explicit `reason` string -- never a silent null. `brain-client.cjs::getApiKey()` is now a one-liner delegating to the resolver (the previous inline 3-path lookup is gone; the docstring is fixed; `Authorization: Bearer` at L218 + L279 and the `BRAIN_REQUEST_TIMEOUT_MS` / `AbortSignal.timeout` / memoized `schema()` / `async function ask` precondition are all upstream of this and untouched). `scripts/session-start`'s Brain block (~L1290-1313) replaces the pre-Plan-7 MCP-centric WARN that tested only the shell env var with a positive 3-case status line: `Brain: HTTP client active (mindrian-brain.onrender.com)` when the key resolves; `Brain: NOT loaded -- permissions too open: ... (run: chmod 600 ~/.mindrian.env)` when SEC-02 rejects; `Brain: not configured (Tier 0)` when nothing is found. The `brain-connector/SKILL.md` Detection section gains a new step 0 (HTTP-path detection via the resolver) and a CLI row in the Tool Names table. `commands/setup.md`'s `~/.mindrian.env` write is now followed by `chmod 600` (SEC-02 fix; no-op on Windows). `install.sh` is annotated -- it does NOT write `~/.mindrian.env` today; if a future code path adds a write, it MUST chmod 600 the file. `docs/install/BRAIN-SETUP.md` and `.env.brain.template` state Bearer-only explicitly and surface the `https://mindrianos.vercel.app/brain-access` request URL + `MINDRIAN_BRAIN_URL` override. Wave-0 hermetic test `tests/test-resolve-brain-key.cjs` (9 scenarios -- env wins / mindrian-env wins over CWD / CWD fallback / not-found / SEC-02 reject / Canon Part 8 grep / getApiKey delegation / brain-client preconditions / FLAG-3 home-default structural assertion) all green; registered in `lib/memory/run-feynman-tests.cjs`. (`lib/core/resolve-brain-key.cjs` [new], `lib/core/brain-client.cjs`, `scripts/session-start`, `skills/brain-connector/SKILL.md`, `commands/setup.md`, `install.sh`, `docs/install/BRAIN-SETUP.md`, `.env.brain.template`, `tests/test-resolve-brain-key.cjs` [new], `lib/memory/run-feynman-tests.cjs`, `lib/memory/security-trifecta.test.cjs`.)
+
+### Fixed
+
+- **Statusline deployment-topology gap (the last thread in the install-machinery family).** A Windows live test on beta.12 confirmed: the statusline-wrapper fix shipped in the plugin cache, but `~/.claude/settings.json` runs the *deployed* `~/.claude/statusline-mos`, which `scripts/session-start` had been re-copying from this hook's `PLUGIN_ROOT` every session -- so when the running hook lagged the just-updated version, the deployed copy stayed stale. Fix: `~/.claude/statusline-mos` is now a **dumb dispatcher shim** (`scripts/statusline-mos-dispatch`, marker `MINDRIAN-STATUSLINE-DISPATCH`) -- zero logic, it just finds an installed plugin version and `exec`s that version's `scripts/statusline-mos`, which does the real (installed_plugins.json-first) resolution and rendering. So a wrapper fix in plugin vN+1 reaches every user on their next session with no re-stamp, and a wrapper bug can never sit stale on the deployment surface. `scripts/session-start` Step A now deploys/migrates the dispatcher: one-time migration from an old logic-bearing `~/.claude/statusline-mos`; no-op once it's already the dispatcher; never touches a non-MindrianOS file at that path (it must contain `MindrianOS statusline` to be replaced). Falls back to the prior full-wrapper copy for plugin versions predating the dispatcher. (`scripts/statusline-mos-dispatch` [new], `scripts/session-start`, `scripts/statusline-mos` header.)
+
+- **`scripts/release.sh:40`'s `IFS='.' read -r MAJOR MINOR PATCH`** mangled pre-release versions (`PATCH=0-beta` from `1.13.0-beta.11`), which is why beta.10 / 11 / 12 were hand-rolled and beta.13 is the first `release.sh`-cut pre-release. Replaced with `semver.inc()` (Plan 123-01).
+- **`scripts/doctor.cjs:40`'s hardcoded `INSTALL_DIR = ~/.claude/plugins/mindrian-os/`** was the `MODULE_NOT_FOUND` source on marketplace-only installs (the disease that surfaced Bug 7). NEW code (class I + class J + new wire-ins) resolves via `resolveActivePluginRoot()`; `INSTALL_DIR` is preserved for existing class A but no longer the source of truth for new code (Plan 123-03).
+- **`scripts/session-start:419`'s `~/.mindrian-last-version` write inside the cold-start `else` branch** never fired on a session WITH an active room -- which is why room-sessions read stale (Pitfall 7). The new install-state record block writes it unconditionally as the single writer in earliest steps; the line-419 write is removed; the line-101 read of the PREVIOUS value is preserved for the transition banner (Plan 123-02).
+- **`commands/setup.md:145`'s stale URL `mindrianos-jsagirs-projects.vercel.app/brain-access`** -> `mindrianos.vercel.app/brain-access` (Plan 123-05; reaffirmed Plan 123-07).
+- **Brain client CHANGELOG prose softened** -- the client currently calls `mindrian-brain.onrender.com`; `brain.mindrian.ai` is the future host; `MINDRIAN_BRAIN_URL` overrides either (Plan 123-07).
+- **`scripts/release-beta-smoke.sh`** retired -- hard-pinned to a stale Phase-89.6 artifact `EXPECTED_VERSION="1.11.0-beta.1"`; `doctor --acceptance --pre-tag` supersedes it (Plan 123-04).
+- **`brain-client.cjs::getApiKey()` precedence** -- was env -> CWD `.env` -> `~/.mindrian.env`; now (via the resolver delegation) env -> `~/.mindrian.env` -> CWD `.env` per D-31. Deliberate: on a maintainer's machine the home file is the canonical key, the CWD file is project-local override (Plan 123-07).
+- **Plan-02 amendment: install-state record `active_version` derivation** -- the original session-start block preferred the dev workspace's `plugin.json` version over the resolver's root basename, so on a maintainer's box (where the workspace can lead the live install) the record contained an internal contradiction (`active_root` pointed at the live install dir; `active_version` named a different version). Surfaced by Plan-06's pre-flight class-I gate 2026-05-13 (commit `69a5240`).
+- **Plan-06 release-flight: `scripts/verify-release` Step 12 "Git State"** died silently on a clean working tree (`git status --porcelain | grep -v "^??" | wc -l` exited non-zero with no tracked uncommitted changes; `set -e` killed the script). Wrapped the grep in `{ ... || true; }` (commit `267d395`).
+- **Plan-06 release-flight: `commands/operator.md` + `commands/doctor.md` YAML frontmatter parse error** -- `argument-hint: [history] [set <op>] [reset] [--json]` confused YAML (multiple flow-sequence-looking tokens on one line); the parser bailed at line 3 and both commands loaded with empty metadata. Wrapped both argument-hint values in double-quoted strings. Latent in `main` for at least a session before Plan-06's stricter pre-flight caught it (commit `b41f232`).
 
 ### Changed
 
-- **npm package renamed: `@mindrian/os` -> `@mindrian_os/cli`.** The `@mindrian` npm scope never existed (the registry returns `{"error":"Scope not found"}`), so `@mindrian/os` could never be published. The maintainer created the `@mindrian_os` org on npm on 2026-05-11; the package now lives at `@mindrian_os/cli`. The `mindrian-os` CLI command (the `bin` entry in `package.json`) is unchanged. `package.json` + `.claude-plugin/plugin.json` bumped to `1.13.0-beta.10` (in progress). Forward-looking references updated in `scripts/release.sh`, `docs/install/PACKAGING-PATHS.md`, `tests/manual/95.6-windows-cold-install-acceptance.md`, `tests/test-release-npm-gate.sh`. The first npm-published version will be `1.13.0-beta.10`, under the corrected name. (The `[1.13.0-beta.9]` entry below is left intact as the historical record of the pre-rename release -- which shipped to GitHub and the marketplace as `v1.13.0-beta.9` but was never published to npm because the `@mindrian` scope didn't exist.)
+- **`data/deployment-surfaces.json`** added -- hand-maintained static manifest; 6 surfaces; reuses the `data/` layout convention from Phase 122 but NOT the generator/`--check` pattern (this file isn't derived from anything; nothing to `--check` it against). Schema extension in Plan-03: optional `path_within_file` field on `exact-value` surfaces points at a JSON sub-field (e.g. `statusLine.command` inside `settings.json`); class-J's `exact-value` check extracts via that path before comparing.
+- **`docs/install/BRAIN-SETUP.md`** + **`.env.brain.template`**: state explicitly that auth is `Authorization: Bearer <key>` only (NOT `x-api-key`); surface the `https://mindrianos.vercel.app/brain-access` URL in the no-key fallback (Plan 123-07).
+- **`docs/CANON-PHASE-MAP.md`**: Phase 123 mapped under **Part 6** (dog-fooding the install lifecycle -- one record + one manifest + one command + one release script; the plugin's own install state honors the plugin's canon) and **Part 7** (reuse justification -- ~90% of Phase 123 extends shipped code; net-new files are `data/deployment-surfaces.json`, `lib/core/resolve-brain-key.cjs`, `lib/core/cache-prune.cjs`, the per-class fixtures) (Plan 123-06 Task 4).
+- **`@mindrian_os/cli` -> `@mindrian_os/install` doc/test sweep** -- forward-facing references across `docs/install/PACKAGING-PATHS.md`, `tests/manual/95.6-windows-cold-install-acceptance.md`, `tests/test-release-npm-gate.sh`, `docs/INSTALL-LIFECYCLE-HARNESS.md` (lines 91/104/124), plus older `@mindrian/os` mentions in `[private case archive]`, `docs/UI-UX-CONVERGENCE-2026-05-10/04-REVERSE-SALIENT-INSTALL.md`, `[private tester archive]`, `docs/testers/outbox/2026-05-07-gary-laben-welcome.md`. Historical CHANGELOG entries stay as the historical record. After the sweep, `grep -rln "@mindrian_os/cli" docs/install/ commands/ tests/test-*.sh scripts/release.sh` returns nothing (Plan 123-05).
+
+### Notes
+
+- **Path C re-route status** (2026-05-05): v1.13.0-beta.13 carries Phase 123 (install-lifecycle-harness). Phase 110 (Brain Context Packet Contract) shipped in parallel during the Phase-123 execution waves; its 6 plans + verification completed on `main` between Plan-05 and Plan-07; it rides along here.
+- **Promotion to clean 1.13.0** gated on a real-Windows `mindrian-os doctor --acceptance` run (Lawrence / operator), per Canon Part 5 (Evidence Is Graded By Context) + Part 6 (Product-as-Venture / dog-fooding mandate). A follow-up `bash scripts/release.sh --finalize` -- NOT this release's work -- cuts the clean `1.13.0` after the Windows gate is green.
+- **Concurrent-execution incidents during the Phase 123 + Phase 110 parallel run** (2026-05-12 to 2026-05-13): a Phase-110 `git add -A` swept Plan 123-05's GREEN files into the wrong commit (`4453292`; work correct, attribution muddled); a Phase-110 commit re-introduced `release-beta-smoke.sh` after Plan 123-04 deleted it (`231f5cd`; Plan-04 re-deleted cleanly); the `fix/brain-client-timeout-ask-schema-cache` branch checkout yanked Plan-123 research's HEAD mid-run (cherry-picked back to `main` as `f03195a`). All recovered without data loss. Pattern documented for a future `gsd-executor` worktree-isolation-by-default improvement.
+
+## [1.13.0-beta.12] - 2026-05-12
+
+The v1.13.0 CAPSTONE release -- headline content is the **Workflow Layer** (Phase 122: framework <-> command registry + reliable invocation; spec at `.planning/WORKFLOW-LAYER-SPEC.md`, doc at `docs/WORKFLOWS.md`) plus the npm-installer overhaul (`npx @mindrian_os/install` is now a real one-command installer), the `@mindrian_os/cli` -> `@mindrian_os/install` rename, and the install-machinery fixes a Windows live test surfaced (doctor/update path resolution, the statusline pre-release blind spot, and the single plugin-root resolver that retires that whole bug family). Version trail to here: `1.13.0-beta.10` (a token-validation npm publish on 2026-05-12 -- now deprecated), `1.13.0-beta.11` (the real npm installer + the package rename, npm-only -- now deprecated, doctor path bug), `1.13.0-beta.12` (this release: the capstone, tagged `v1.13.0-beta.12`, marketplace `source.ref` pinned, `@mindrian_os/install` published with the `@next` dist-tag).
+
+### Added
+
+- **The Workflow Layer (Phase 122) -- the framework-to-command registry + reliable invocation.** Larry can now turn "the methodology suggests framework X" into "run `/mos:x`" as a CI-enforced guarantee, not model recall:
+  - **`data/command-registry.json`** -- the generated, committed framework-to-command registry (`{ ontology_ref, commands[], framework_index, curated_chains[] }`), built from each `commands/*.md` frontmatter; never hand-edited. Plus `data/framework-names.json` -- the FEEDS_INTO-linked Brain `:Framework` name slice (+ a small curated whitelist), the only Brain-derived artifact in this loop.
+  - **`scripts/build-command-registry.cjs`** -- the generator + the `--check` drift tripwire (fails on a stale registry or an unresolvable framework name) + `--refresh-names` (a read-only build-time Brain query that snapshots the allowlist). The `--check` is wired into the pre-commit hook (when any `commands/*.md` / `data/command-registry.json` / `data/framework-names.json` is staged) and the Feynman test runner.
+  - **`lib/workflow/command-resolver.cjs`** -- the SOLE deterministic framework-to-command door (`commandsForFramework`, `frameworksForCommand`, `composeWorkflow`, `validateChainAutonomy`); reads only `data/command-registry.json`; zero Brain calls; degrades to empty results / `{ command: null, optional: true }` on a missing registry or a command-less framework (degrade, do not fabricate).
+  - **`lib/brain/chain-recommender.cjs`** -- `recommendFrameworkChain({problemType?, currentFramework?, roomState?}) -> [frameworkName]` via the Brain's `FEEDS_INTO` traversal (framework names + problem-type enums only, never a command string, never user content); degrades to `[seed]`.
+  - **The five new `/mos:` command frontmatter keys** -- `kind` (`methodology | utility | meta`), `frameworks[]` (the exact Brain `:Framework` name(s)), `produces`, `inputs`, `autonomous_safe` -- retrofitted across 44 commands (the algorithmic cohort first). Contract: `docs/COMMAND-FRONTMATTER.md`.
+  - **`/mos:pipeline --from-problem-type <x>` / `--from-framework <x>`** -- Brain-derive the chain, compose commands, print the `/mos:` run order. **`/mos:act --chain`** -- runs the composed workflow but `validateChainAutonomy` first and STOPS at the first non-`autonomous_safe` (or command-less) step with a "needs you here" gate (the Canon Part 3 "human confirms" clause made literal). **`/mos:suggest-next`** -- now returns a step-numbered command sequence, not just a framework list.
+  - **The pre-commit registry-drift tripwire** -- `build-command-registry.cjs --check` runs in `.git/hooks/pre-commit`; the Feynman runner runs it too.
+  - **`docs/WORKFLOWS.md`** -- the Brain <-> registry <-> Larry join, the five reliability rules, the Canon Part 8 boundary (commands never enter the Brain -- no `Command` node, ever), and the resolver/recommender surface. `docs/THE-BRAIN.md` and `docs/CANON-PHASE-MAP.md` point at it.
+  - **`lib/memory/workflow-layer-e2e.test.cjs`** -- walks frontmatter -> `build-command-registry --check` -> `resolver.composeWorkflow(the spec's acceptance example)` -> the command-less degrade case -> the `validateChainAutonomy` stop-point, then runs the Canon Part 8 zero-Brain-mutation grep sweep. Registered in the Feynman runner + `tests/run-all-122.sh`.
+- **`npx @mindrian_os/install` is a real one-command installer, not a printout.** Previously `npx @mindrian_os/cli install` only echoed the marketplace commands for the user to paste into Claude Code by hand ("no side effects, just guidance"). It now drives Claude Code's own plugin CLI: it checks that `claude` is on PATH (and prints how to install Claude Code if not), runs `claude plugin marketplace add jsagir/mindrian-marketplace`, then `claude plugin install mos@mindrian-marketplace`. Running it with no subcommand -- or with only flags, e.g. `npx @mindrian_os/install --version 1.13.0-beta.9` -- does the install; flags pass through to `claude plugin install`. `doctor` and `update` are still explicit subcommands. The Brain key stays a printed hint -- writing it to the environment is the one side effect left to the user. This unblocks un-gating the npm-quick-install card on the install site (`mindrianos-install-site.vercel.app`). (`bin/cli.js`.)
+  - Post-beta.11 follow-up (2026-05-12, after a Windows live test): `mindrian-os doctor` / `update` were resolving the plugin at the legacy `~/.claude/plugins/mindrian-os/` path, which does not exist for a `claude plugin install` -- the plugin is named `mos` and lives at `~/.claude/plugins/cache/<marketplace>/mos/<version>/`. So `npx @mindrian_os/install doctor` was throwing a raw node `MODULE_NOT_FOUND` stack. `bin/cli.js` now resolves the plugin root in order (MINDRIAN_OS_ROOT -> newest marketplace-cache `mos/<version>/` with a `scripts/doctor.cjs` -> legacy clone -> not-found), prints a plain "not installed -- run `npx @mindrian_os/install`" message when truly absent, and `update` uses `claude plugin marketplace update` + `claude plugin update mos@mindrian-marketplace` for a marketplace install (the `git pull` + `install.sh` path is kept only for a dev clone / MINDRIAN_OS_ROOT). The `install` flow also now runs `claude plugin marketplace update` then `claude plugin install` + `claude plugin update` (so an already-installed plugin gets moved to the current ref rather than just reported "already installed", which was the misleading message in the Windows test where the version actually moved 1.12.0 -> 1.13.0-beta.9). Lands in the next `@mindrian_os/install` npm publish.
+  - Same Windows test surfaced a pre-release blind spot in `scripts/statusline-mos` (the self-healing statusline resolver): it picked the "latest" cache version with `grep -E '^[0-9]+\.[0-9]+\.[0-9]+$'`, which rejects `-beta.N` suffixes. A box with `1.12.0` + `1.13.0-beta.9` in the marketplace cache picked `1.12.0`, rendered the stale statusline from there, and exported `MINDRIAN_OS_ROOT` pointing at it -- so the version banner / room-context lookup / focus glyph were all computed from the wrong version. Widened the anchor to `^[0-9]+(\.[0-9]+)+(-[A-Za-z0-9.]+)?$` (`sort -V` already orders pre-releases correctly: `1.12.0 < 1.13.0-beta.9 < 1.13.0`). Ships in the next plugin release; the deployed `~/.claude/statusline-mos` (or the `register_statusline` block in `~/.claude/settings.json` that points at `<install-dir>/scripts/statusline-mos`) picks it up when the plugin re-stamps on next install/update. Immediate workaround on an affected box: delete the stale lower-version cache dir under `~/.claude/plugins/cache/mindrian-marketplace/mos/`.
+  - Root-cause fix (the three above were band-aids on three independent guessers): **`lib/core/active-plugin-root.cjs`** -- the ONE plugin-root resolver. Precedence: `MINDRIAN_OS_ROOT` env -> `~/.claude/plugins/installed_plugins.json` (Claude Code's own registry of the *active* `mos@mindrian-marketplace` install; temporal truth -- right even when "highest semver" isn't the active version) -> newest pre-release-tolerant `~/.claude/plugins/cache/<marketplace>/mos/<version>/` -> legacy `~/.claude/plugins/mindrian-os/` -> not-found. Usable as a module (`resolveActivePluginRoot()`) and as a CLI (`node active-plugin-root.cjs` prints the path; `--json` for `{root, source}`). `bin/cli.js` (doctor/update) now delegates to it; `scripts/statusline-mos` shells out to its CLI form (with the cache-scan as a fallback for older deployed copies of the wrapper). Reads LOCAL files only (Canon Part 8). Still TODO (separate, lower-risk pass): have `scripts/session-start` re-stamp the `register_statusline` block in `~/.claude/settings.json` from this resolver on every run, so the deployed wrapper / settings pointer can never drift.
+
+### Changed
+
+- **`/mos:suggest-next` returns a command sequence**, not just a framework list; **`framework-chain-composer.proposeNextFramework` routes through `lib/workflow/command-resolver.cjs`** (the only door -- `command:null` degrade for a command-less next framework); **the `pws-methodology` and `brain-connector` skills point at the resolver** (framework routing goes through `command-resolver.commandsForFramework` / `composeWorkflow`, never a `/mos:` named from memory). **The three remaining hand-maintained framework-to-command maps were pruned:** `framework-chain-composer.FRAMEWORK_TO_COMMAND_SLUG` is now an empty back-compat export, `lib/hmi/jtbd-taxonomy.json:methodology_hooks` is marked informational-only (the resolver is authoritative), and `references/methodology/index.md` is now just a pointer to `docs/COMMAND-FRONTMATTER.md` / `data/command-registry.json` / `docs/WORKFLOWS.md` -- it no longer hand-maintains a routing table.
+- **npm package renamed (twice): `@mindrian/os` -> `@mindrian_os/cli` -> `@mindrian_os/install`.** First rename (2026-05-11): the `@mindrian` npm scope never existed (`{"error":"Scope not found"}`), so `@mindrian/os` could never be published; the maintainer created the `@mindrian_os` org and the package moved to `@mindrian_os/cli`; first npm publish was `@mindrian_os/cli@1.13.0-beta.10` on 2026-05-12 (a token-validation build, dist-tag `@next`, no git tag, not on the marketplace) -- now deprecated. Second rename (2026-05-12): `@mindrian_os/cli` implied "a CLI tool" / a guidance printer, which is exactly what it had been; once `install` became a real installer the package name should be the verb, so it moved to `@mindrian_os/install` -- `npx @mindrian_os/install` reads as "install MindrianOS". The `bin` entry stays `mindrian-os` (the post-install command for `doctor`/`update`). `package.json` + `.claude-plugin/plugin.json` ship as `1.13.0-beta.12` (this release); the npm-only intermediate publishes `@mindrian_os/cli@1.13.0-beta.10` and `@mindrian_os/install@1.13.0-beta.11` are deprecated. The install site's npm-quick-install card already names `@mindrian_os/install`; `scripts/release.sh` still says `@mindrian_os/cli` (Step 9.5) and only handles clean `X.Y.Z` bumps (it choked on the pre-release version, so this release was hand-rolled per the CLAUDE.md release process) -- both worth a follow-up. `docs/install/PACKAGING-PATHS.md`, `tests/manual/95.6-windows-cold-install-acceptance.md`, `tests/test-release-npm-gate.sh` still name `@mindrian_os/cli` and need updating to `@mindrian_os/install`. (The `[1.13.0-beta.9]` entry below is left intact as the historical record of the pre-rename release -- which shipped to GitHub and the marketplace as `v1.13.0-beta.9` but was never published to npm.)
+
+### Fixed
+
+- **The hallucinated-command failure mode.** Larry could name a non-existent or semantically wrong command -- e.g. `/mos:jtbd` for the JTBD *methodology* when `/mos:analyze-needs` is the framework command (`/mos:jtbd` is the active-JTBD management command, not a methodology runner). With the Workflow Layer, every command Larry surfaces comes back from `lib/workflow/command-resolver.cjs` reading the generated registry -- `composeWorkflow(["Jobs to Be Done (JTBD)"])` returns `/mos:analyze-needs`. A hallucinated command cannot be emitted.
+- **A latent Canon Part 8 breach in prose.** `skills/brain-connector/SKILL.md` carried dead "Brain has Command nodes linked to Frameworks ... `brain_proactive_command` ... `FOLLOWS_FRAMEWORK -> Command`" prose, and `references/brain/command-triggers-schema.md` was a whole dead "commands are first-class Neo4j nodes" schema doc -- both asserted that plugin commands live in the Brain, which the live Brain never implemented (no `Command` label) and which Canon Part 8 forbids. Both were deleted; the `command-triggers-schema.md` path now carries a `REMOVED` tombstone pointing at the Workflow Layer. The `lib/memory/workflow-layer-e2e.test.cjs` grep sweep now fails the build if a `Command`-node assertion ever returns anywhere in `skills/`, `agents/`, or `references/`.
+
+### Maintainer Notes
+
+- **Release steps (maintainer-gated -- NOT performed in this phase):** cut the `v1.13.0-beta.11` tag, pin `~/mindrian-marketplace/.claude-plugin/marketplace.json` `source.ref` to the tag, and `npm publish @mindrian_os/install` with the `@next` dist-tag -- per the CLAUDE.md release process and the `feedback_release_lockstep_npm` rule (every plugin release publishes the npm package in lockstep). Phase 122 only finalized this CHANGELOG block and shipped the Workflow Layer code/docs/tests; it did not bump any version, did not `git tag`, did not `npm publish`, and did not edit `marketplace.json`.
 
 ### Notes
 
@@ -24,11 +359,11 @@ beta.10 is the v1.13.0 CAPSTONE -- its headline content is the **Workflow Layer*
 
 ## [1.13.0-beta.9] - 2026-05-11
 
-Phase 95.6 -- install-cache Windows hardening + skill-loop resilience. Closes case #4 in the install-cache failure family (the 2026-05-08/09 Gary Laben Windows 11 install). Release infrastructure ships as a beta first per the project release policy; this beta is opt-in only.
+Phase 95.6 -- install-cache Windows hardening + skill-loop resilience. Closes case #4 in the install-cache failure family (the 2026-05-08/09 the Wave-2 tester Windows 11 install). Release infrastructure ships as a beta first per the project release policy; this beta is opt-in only.
 
 ### Fixed
 
-- **install.sh skill-loop no longer aborts on a structurally-incomplete skill (D-03).** A skill directory missing its `SKILL.md` now produces a `WARN: skipping skill <name>: no SKILL.md` on stderr and the install continues, instead of hitting `set -euo pipefail` and halting mid-loop. This is the bug that broke Gary Laben's install live on 2026-05-08/09 (`cp: cannot stat '.../skills/mullins-scaffold//SKILL.md'`, exit 1, leaving agents / hooks / settings.json / larry-extended-default unwritten). Also backfilled the missing `skills/mullins-scaffold/SKILL.md` data file.
+- **install.sh skill-loop no longer aborts on a structurally-incomplete skill (D-03).** A skill directory missing its `SKILL.md` now produces a `WARN: skipping skill <name>: no SKILL.md` on stderr and the install continues, instead of hitting `set -euo pipefail` and halting mid-loop. This is the bug that broke the Wave-2 tester's install live on 2026-05-08/09 (`cp: cannot stat '.../skills/mullins-scaffold//SKILL.md'`, exit 1, leaving agents / hooks / settings.json / larry-extended-default unwritten). Also backfilled the missing `skills/mullins-scaffold/SKILL.md` data file.
 - **Windows long-path failures during `git clone` (D-01).** install.sh now detects Windows + Git Bash, runs `git config --global core.longpaths true` before the clone (with an explanatory banner about the global git-config change), cleans a stale partial-clone directory before a retry, and fails with a clear "Git for Windows" error + download link if git is missing on Windows. OS detection is testable on Linux CI via `MOS_TEST_FORCE_OS`.
 - **The "silent install-incomplete" failure mode (D-09).** install.sh now registers the statusLine block FIRST (idempotently, via `register_statusline()`) so a later skill-loop WARN can never again leave the bottom-of-terminal statusline unstamped; it writes an `.install-receipt.json` so a halted install is detectable; `/mos:doctor` gained a class H (`install-incomplete`) that detects a missing statusLine block, reads the receipt, and `--fix` re-stamps the block idempotently; a fresh first session auto-runs `/mos:doctor` and surfaces all-green or names what is missing.
 - **`tests/test-navigation-memory-events.cjs` `test1_enumCount`** now asserts a floor (`EVENT_TYPES.size >= 19`) rather than an exact count, so adding event types in later phases no longer breaks the Phase 109 baseline test (the required-types membership loop still pins the baseline). Resolves a deferred item from Phase 88.2.
@@ -42,7 +377,7 @@ Phase 95.6 -- install-cache Windows hardening + skill-loop resilience. Closes ca
 - **Explicit Brain / methodology access declared on all sub-agents (D-10)**, plus a **Deferred Tool Loading note** in `mcp-server-brain/CLAUDE.md` (D-11b: the <=10-15 startup-tools cap + schema-on-demand rule + the current Brain-MCP startup tool count of 6).
 - **`docs/install/PACKAGING-PATHS.md` (D-05e/f)** -- the four distribution paths (Marketplace + GitHub, Marketplace + npm, ZIP-URL, CI-Docker pre-bake) with "use this when..." guidance; the `CLAUDE_CODE_PLUGIN_SEED_DIR` / `CLAUDE_CODE_PLUGIN_CACHE_DIR` pre-bake flagged as the recommended NATO faculty deployment.
 - **README `## Manual Recovery` section (D-04)** -- step-by-step recovery for a halted install (re-run `install.sh`; manual agent symlink + `/mos:doctor --statusline-visibility --fix`; verify with `/mos:doctor --all`), plus a CMD-vs-PowerShell note. And a permission-prompts note in the README install section (D-03 ergonomics: 10+ prompts are normal, `always allow` shortcut, the new `WARN: skipping skill` line).
-- **Case #4 install-failure autopsy.** `docs/autopsies/2026-05-09-gary-laben-install-failure.md` -- the 2026-05-08/09 Gary Laben install (Surface Pro 7, Windows 11, the live 66-minute call), six root causes (Windows MAX_PATH, install.sh skill-loop halt, `@mindrian/os` never published, statusLine never registered, PowerShell-vs-CMD shell variability, permission-prompt fatigue), the install-cache failure family pattern (case #4 after #1 wrong-workspace, #2 Phase 93 drift-recovery, #3 Phase 95.2 atomic-recovery), the Phase 95.6 fixes, cross-references. Brain key UUIDs redacted per REC-05.
+- **Case #4 install-failure autopsy.** `[private case archive]` -- the 2026-05-08/09 the Wave-2 tester install (Surface Pro 7, Windows 11, the live 66-minute call), six root causes (Windows MAX_PATH, install.sh skill-loop halt, `@mindrian/os` never published, statusLine never registered, PowerShell-vs-CMD shell variability, permission-prompt fatigue), the install-cache failure family pattern (case #4 after #1 wrong-workspace, #2 Phase 93 drift-recovery, #3 Phase 95.2 atomic-recovery), the Phase 95.6 fixes, cross-references. Brain key UUIDs redacted per REC-05.
 - **`scripts/check-first-touch-drift.cjs` + `tests/test-first-touch-drift-scanner.cjs` (D-07)** -- scans the first-touch surfaces for em-dashes, stale version literals (scoped to greeting copy), and `BSL-1.1` adjacent to "open source" (SEED-007 pattern 3). `MOS_TEST_SCAN_DIR` override.
 
 ### Changed
@@ -259,7 +594,7 @@ Phase 117 was originally targeted at v1.13.0-beta.3 per CANON-PHASE-MAP.md, then
 ### Manual action items
 
 - **POST-MERGE WEBSITE EDIT:** apply the website hero rewrite from `docs/copy/115-website-hero.md` to `~/mindrian-website/[hero file]`. The website repo is independent of MindrianOS-Plugin; this is NOT auto-applied. The deliverable + step-by-step is in `docs/copy/115-website-hero.md`.
-- **VALIDATION WEEK:** dispatch `tests/fixtures/115-validation-email-template.md` to the 5-tester cohort (Lawrence Aronhime + Justin Stitzlein + Aryeh Holtzberg + Adam Peters + Shmuel Schuman) per D-13 (async, 48h reply window). Synthesize replies into `tests/fixtures/115-tester-rubric.md`.
+- **VALIDATION WEEK:** dispatch `tests/fixtures/115-validation-email-template.md` to the 5-tester cohort (Lawrence Aronhime + a tester + Aryeh Holtzberg + Adam Peters + a tester) per D-13 (async, 48h reply window). Synthesize replies into `tests/fixtures/115-tester-rubric.md`.
 - **D-20 ROLLBACK GATE (Pitfall 5 pre-commit):** if validation lands < 4-of-5 vivid recent memory, execute `tests/manual/115-rollback-procedure.md` step-by-step. Pre-committed; no live deliberation.
 - **MARKETPLACE Gate 5 (deferred):** ref-pin `~/mindrian-marketplace/.claude-plugin/marketplace.json` `source.ref` to `v1.13.0-beta.3` ONLY after the 5-tester async validation passes 4-of-5 AND the 3-tester live empathy audit (`tests/manual/115-acceptance.md`) reports 2/3 pass. Until then, Phase 115 ships as a LOCAL-ONLY tagged build (no `git push`, no marketplace ref-pin).
 
@@ -863,7 +1198,7 @@ Stable users on 1.11.0 are not affected.
 
 ### Fixed (Phase 93 D1: Brain telemetry visibility)
 
-- **`mcp-server-brain/brain-admin.cjs`** column-name mismatch (5 occurrences across `cmdList` + `cmdUsage`): read `total_requests` and `last_request_at` instead of stale/dead `request_count` and `last_used_at`. Result: `/mos:admin keys` and `/mos:admin usage` now display real adoption numbers instead of universal zero. Verified post-fix: jsagir Desktop=378, Leah Aronhime=37, Lawrence Aronhime=26, plus six smaller users — matches Supabase ground truth.
+- **`mcp-server-brain/brain-admin.cjs`** column-name mismatch (5 occurrences across `cmdList` + `cmdUsage`): read `total_requests` and `last_request_at` instead of stale/dead `request_count` and `last_used_at`. Result: `/mos:admin keys` and `/mos:admin usage` now display real adoption numbers instead of universal zero. Verified post-fix: jsagir Desktop=378, an admin-key holder=37, Lawrence Aronhime=26, plus six smaller users — matches Supabase ground truth.
 - **`mcp-server-brain/lib/auth.cjs`** `logUsage()` insert column: write to `api_key` instead of nonexistent `key_id`. Previous code silently dropped 452 telemetry events with `PGRST204` errors swallowed by an upstream fire-and-forget `.catch()`. Brain usage log now fills correctly from this release forward; tool-level granularity restored.
 
 ### Added (Phase 93 D2: install-cache drift recovery)
@@ -992,7 +1327,7 @@ The first command refreshes the marketplace catalog so v1.11.0 becomes visible.
 
 ## [1.11.0-beta.1] - 2026-04-27
 
-Beta release of the Reverse Salient (RS) Discovery Engine for opt-in testers (Justin / Aryeh). Stable users on v1.10.19 are NOT auto-updated; opt-in is explicit. Phase 91 Navigation Engine is NOT yet wired -- coming in beta.2. Tester sign-off promotes to stable v1.11.0 in Phase 91.5.
+Beta release of the Reverse Salient (RS) Discovery Engine for opt-in testers (the Wave-1 testers). Stable users on v1.10.19 are NOT auto-updated; opt-in is explicit. Phase 91 Navigation Engine is NOT yet wired -- coming in beta.2. Tester sign-off promotes to stable v1.11.0 in Phase 91.5.
 
 ### Tester Opt-In
 
@@ -2346,7 +2681,7 @@ Windows hotfix and Mac parity release. Ships Phase 85 (10 plans) addressing cros
 - **(WIN-FIX-F) run-hook.cmd exit code propagation (security-adjacent).** `hooks/run-hook.cmd` on Windows was swallowing bash exit codes because `%ERRORLEVEL%` inside an `if(...)` block is parse-time expanded, not runtime. PreToolUse write-scope-check returned 0 even when bash emitted exit 2, so the Phase 83 sealed-room write guard was silently inert on Windows for v1.10.7 and v1.10.8. **Security-adjacent: the sealed-room write guard was inert on Windows in v1.10.7 and v1.10.8. If you moved files into another room on Windows during that window, Larry's judgment was the only thing stopping it.** Fix uses `setlocal enabledelayedexpansion` with `!ERRORLEVEL!` captured into RC and `endlocal & exit /b %RC%` across all three bash invocation branches. Regression fixture at `tests/test-run-hook-cmd.cjs`.
 - **(WIN-FIX-B) `vunknown` banner on Windows.** `scripts/session-start` was reading plugin.json via `python3 -c "import json; json.load(...)"`. On Windows fresh installs, `python3` resolves to the Microsoft Store alias stub and silently exits non-zero, the `|| echo unknown` fallback fires, and users see `vunknown` in their banner instead of the real version. Now uses node via `lib/core/platform.cjs` `readPluginJsonVersion()`.
 - **(WIN-FIX-H) Cross-platform banner rendering and dispatch.** Introduced `lib/core/platform.cjs` centralizing OS detection, terminal code page handling, and hook script path resolution. Session-start banner now renders correctly on all platforms (UTF-8 box-drawing with ASCII fallback on non-UTF-8 terminals), statusline wrapper paths resolve through the helper, and python3 invocations have been audited across scripts/ with OS-aware gating.
-- **Mac `stat -c` portable fallback (LAWRENCE-001).** Confirmed that session-start, sentinel-health-check, on-task-complete, and post-compact use a `portable_stat_mtime` helper handling both GNU and BSD `stat`. Reported by Lawrence Aronhime (Johns Hopkins) via structured Mac environment audit on 2026-04-15.
+- **Mac `stat -c` portable fallback (LAWRENCE-001).** Confirmed that session-start, sentinel-health-check, on-task-complete, and post-compact use a `portable_stat_mtime` helper handling both GNU and BSD `stat`. Reported by Lawrence Aronhime via structured Mac environment audit on 2026-04-15.
 - **Lying header comment at `scripts/self-update` line 14** claimed the rewrite "abandons the atomic-swap-via-rename dance entirely" while line 325 still executed `mv`. Replaced with the truth: Windows uses `cp -a`, POSIX keeps `mv`, and the bootstrap handoff sidesteps the self-overwrite hazard.
 - **Regression fence:** new `tests/test-self-update-platform.cjs` covers the four scenarios from LASZLO-001 (win32 vs linux INSTALL_METHOD selection, `readPluginJsonVersion` helper without python3, `/tmp/` prefix resolution, and end-to-end bootstrap install in both branches) plus explicit J-1 ghost guards. Registered in `lib/memory/run-feynman-tests.cjs` (17/17 test files green).
 
@@ -2360,7 +2695,7 @@ Windows hotfix and Mac parity release. Ships Phase 85 (10 plans) addressing cros
 ### Credits
 
 - **László Személyi (Laszlo Szemelyi)**, Neumann Technology Platform, Hungary, for the detailed Windows self-update failure report including five screenshots of the `/mos:update` transcript (LASZLO-001, 2026-04-15). The "token-eating challenge" phrasing was the hook that surfaced the J family.
-- **Lawrence Aronhime**, Johns Hopkins, for the structured Mac environment audit covering nine sections from environment fingerprint to feature coverage analysis, including the Python ML dependency gap that drove the whitespace auto-install work (LAWRENCE-001, 2026-04-15).
+- **Lawrence Aronhime** for the structured Mac environment audit covering nine sections from environment fingerprint to feature coverage analysis, including the Python ML dependency gap that drove the whitespace auto-install work (LAWRENCE-001, 2026-04-15).
 
 ### Upgrade instructions
 
@@ -2451,7 +2786,7 @@ Upgrade path: standard two-command `/plugin marketplace update` followed by `cla
 
 ### Credit
 
-Bug reported by Lawrence Aronhime (lawrence@mindrian.ai, Prof., Johns Hopkins Carey Business School) on 2026-04-13 23:23. Lawrence has been running beta builds since v1.9.x and holds the lawrence@mindrian.ai admin Brain API key issued 2026-03-26. He built a same-night workaround on his own machine by injecting artifact data directly into `ROOM_DATA`, then filed the bug for the rest of the beta cohort. Eight releases shipped between his report and this fix. Thank you, Lawrence.
+Bug reported by Lawrence Aronhime (lawrence@mindrian.ai) on 2026-04-13 23:23. Lawrence has been running beta builds since v1.9.x and holds the lawrence@mindrian.ai admin Brain API key issued 2026-03-26. He built a same-night workaround on his own machine by injecting artifact data directly into `ROOM_DATA`, then filed the bug for the rest of the beta cohort. Eight releases shipped between his report and this fix. Thank you, Lawrence.
 
 ## [1.10.4] - 2026-04-14
 
@@ -2804,7 +3139,7 @@ onboard_steps:
 
 onboarding: true
 onboard_steps:
-  - "NEW: /mos:whitespace -- find what's MISSING in your venture. Maps gaps using embedding-space density analysis, based on Huan He's SemNovel research (Yale)."
+  - "NEW: /mos:whitespace -- find what's MISSING in your venture. Maps gaps using embedding-space density analysis, based on the researcher's SemNovel research (Yale)."
   - "MindrianOS now has a Model Data Room -- 168 artifacts across 10 sections, built from 45 meeting transcripts, 43 research papers, 35 PWS frameworks."
   - "HSI Spectral Analysis on real evidence -- 20 cross-domain innovation pairs discovered, reverse salients identified."