@mindrian_os/cli 1.15.3-beta.3 → 1.15.3-beta.30

package/CHANGELOG.md

@@ -1,8 +1,459 @@
-## [1.15.3-beta.3] - 2026-07-05
+## [1.15.3-beta.30] - 2026-07-20
 
 ### Added
 - 
 
+## [1.15.3-beta.28] - 2026-07-18
+
+### Added
+
+- **Eureka: killed two distinct causes of unusable portfolio-scan output, plus a warm-cache
+  MCP path.** Live-verified on two independently-chosen real rooms
+  (`aion-eureka-synergy`, `iia-deeptech-centers`), not just fixture-green.
+
+  - **Seam 2 (statement-metadata gap, RESOLVED).** Every entity-entity Opportunity Statement
+    was rendering the literal placeholder text "unknown x unknown approach to a unknown x
+    unknown cross-domain bridge" instead of a real mechanism. Root cause: Phase 218 wired
+    entity nodes (company/technology/market) into the 215 opportunity-statement pipeline but
+    patched only the `title` slot for that node class, leaving `section`/`primary_problem`/
+    `problems`/`shared_problems` falling through to content-node defaults entity nodes
+    structurally can't satisfy. Fixed in `lib/core/eureka/room-native-substrate.cjs`: the
+    entity-node branch now inherits `section` from its already-shipped `DESCRIBES` edge to its
+    source memory_artifact (55/56 entities have one; pure composition over an existing edge,
+    sibling of the prior title fix), with an `entityType` fallback for the remainder, plus a
+    relation-edge-typed bridge label (`competes-with`/`uses-component`/`supplies-to`) in
+    `scripts/eureka-portfolio-report.cjs` instead of the generic phrase. 22/25 -> 0/25
+    "unknown x unknown" statements on both proving rooms.
+  - **Seam 3 (candidate-generation gap, RESOLVED).** Real content was getting ranked against
+    its own containing section (`problem-definition` x `problem-definition`) because `Section`
+    container nodes -- the room's own top-level folder nodes -- were admitted as pairing
+    candidates. The critic already had a correctly-firing rejection tag for this
+    (`domain_swap_invariant`) but nothing upstream excluded these pairs before they consumed
+    ranked-list slots. Fixed with an additive either-endpoint `Section` exclusion at the same
+    generation-layer insertion point the 260715-0nj scaffold-pair fix established (Reuse
+    Before Build), with an honest `container_pairs_excluded` counter surfaced in provenance.
+    1,575 degenerate pairs (9.8% of the candidate set) excluded on `iia-deeptech-centers`;
+    proven a true no-op on `aion-eureka-synergy` (0 Section nodes there) by output diff, not
+    by assertion.
+  - **New: `eureka-run`/`eureka-status`/`eureka-report` on the `intelligence` MCP router
+    tool.** Calls the same governed dispatcher (`scripts/eureka-command.cjs` `main(argv)`)
+    in-process instead of spawning a fresh child process per call, so
+    `embedding-spine.cjs`'s existing module-level encoder cache stays warm across scans on
+    the Phase 198 resident daemon (spiked: same-process call 2 is 0ms vs. call 1's 179ms,
+    unmodified cache mechanism). Transport-gated per call: in-process on the http resident
+    daemon; detached child on stdio, since `process.stdout` is the JSON-RPC framing channel
+    there and the scan writes progress to stdout. Registered on the `intelligence` tool's
+    enum only, outside the 65-command CLI/MCP parity array (mirrors the `eureka_critic`
+    precedent). `/mos:eureka`'s CLI behavior and output contract are unchanged (verified
+    byte-identical).
+
+  Flagged, deliberately out of scope for this pass: Seam 1 (entity-extraction noise --
+  generic-noun and near-duplicate entities still reach the ranker on `aion-eureka-synergy`,
+  tracked separately) and a newly-observed WhitespaceZone-dominated pairing pattern on
+  `iia-deeptech-centers` (AHP composite doesn't differentiate a room where ~87% of nodes are
+  whitespace hypotheses) -- both real, both future work, neither papered over.
+
+- **Phase 230: MindrianOS Skill Fleet Optimization -- the harness for testing whether
+  MindrianOS's own 124 skills trigger correctly and stay quiet when they shouldn't.**
+  Two workstreams. WS1 (trigger-accuracy, all 124 skills): per-family eval-query generation
+  exploiting sibling near-misses, a roster-wide judge funnel (one call scores a query against
+  all 124 skill descriptions at once, catching competitive collisions isolated per-skill
+  grading structurally cannot see), flagged skills escalate to a real live trigger-test loop
+  with train/validation-gated description revision. WS2 (code-quality, the ~59 script/
+  workflow-backed skills -- the design estimated ~10-20, the real inventory came in ~3x
+  higher, disclosed rather than silently re-scoped): adversarially-verified review
+  (Refute-or-Promote) with a deterministic evidence-quote anchor so a fabricated finding
+  cannot reach the report. Live-smoke-tested end to end on a 13-skill human-approved
+  calibration set (`scripts/skillopt-*.cjs`, `lib/core/skillopt-schemas.cjs`,
+  `tests/run-all-230.sh`, 9 deterministic legs): the real Skill-fire detector proved correct
+  in both directions on fresh live captures (it turned out MindrianOS's own `mos:` skills
+  fire via an MCP tool call, not Claude Code's native Skill tool -- caught before anything
+  was built on the wrong assumption), and WS2 independently re-discovered the real
+  `check-card-fire.cjs` over-enforcement defect (see Fixed, below) with zero false positive
+  on a known-clean control. The smoke calibration gate itself came in under tolerance (30%
+  agreement vs. an 85% bar) -- accepted as informative, not blocking, since most of the gap
+  is real full-roster collisions a human's isolated pre-labels couldn't see plus one disclosed
+  query-labeling bug; the reconciliation (fix the labeling bug, re-run smoke) is tracked as
+  SEED-061, not silently dropped. **The full 124-skill fleet run and any multi-agent
+  Workflow-tool orchestration are explicitly deferred behind a future opt-in -- this release
+  ships the harness, not a fleet run.** Nothing was ever written to a real `SKILL.md` or
+  script; every proposed change surfaces in a human-approved report only.
+
+### Fixed
+
+- **`check-card-fire.cjs` no longer force-fires the Decision-Gate card on plain prose with no
+  actual gate.** Two independent over-fire mechanisms, logged three times across 12 days
+  (2026-07-05, 2026-07-11, 2026-07-17) before being root-caused against a live 17-record
+  intercept-log replay: (1) the backstop's bare numbered-prose detector had a 7/7
+  false-positive rate in the logged evidence and zero true catches -- retired outright,
+  genuine ASCII-box degrades stay caught by the separate bracket-arm detector, unchanged;
+  (2) the primary registry-gated path fired on `ran_entries` alone, which a side-channel
+  session-key/TTL union bled into every turn for roughly 10 minutes regardless of relevance
+  -- now requires a confirmed, non-empty gate-subject plus relevance against that real
+  subject. Verified against all 7 real logged firings (0/7 re-fire) plus the full
+  card-fire-specific suite (11/11 + 27 assertions). Trade-off, disclosed not hidden: a lone
+  genuine numbered-prose fork no longer force-fires at the hook level and now depends on the
+  model's own Phase-210/SEED-021 judgment -- the same trust boundary the existing
+  under-firing watch (`feedback_false_success_silent_skip_gates_academy_testers.md`) already
+  tracks from the opposite direction.
+- **Per-session room binding no longer re-prompts every turn after a real bind.** The MCP
+  `room_bind` tool wrote the session's binding state keyed by the actual Claude session UUID;
+  the CLI `UserPromptSubmit` hook read it keyed by `process.env.CLAUDE_SESSION_ID`, which is
+  unset in that hook's execution context, so it silently fell back to a
+  `sha256(roomDir+day)` hash key that never matched -- confirmed with an exact hash-vs-
+  on-disk-filename proof, not inferred. The hook now reads the real session id from its own
+  stdin payload first. This also un-breaks Phase 225's zero-score gate (SEED-039), which
+  shared the same key-mismatch root and was never separately regressed -- just never covered.
+- **The reach/navigation dial no longer offers a topically-unrelated room or claim with no
+  relevance check.** `cross_room` was a permanent member of the reach candidate bank, always
+  offered in a cold room's top-3 regardless of what the live conversation was actually about,
+  filtered only by advisory instruction text the model had to apply itself. A structural
+  relevance gate (`lib/hmi/reach-relevance-gate.cjs`) now suppresses off-topic candidates by
+  token overlap against the live turn before they're ever offered; `cross_room` also no
+  longer "borrows from itself" (filling its own room-name slot with the current room).
+
+## [1.15.3-beta.26] - 2026-07-16
+
+### Added
+- **Phase 227: Ignite / mode-select timing across turns 1-4 (SEED-060).** The session-start
+  mode-selection Decision Gate (Just Talk / Explore+Capture / Build a Room) gets a structural,
+  advisory-only backstop: a new `doctor.cjs` check class (`lib/core/mode-select-sidechannel.cjs`
+  + `lib/core/doctor/mode-select-checkpoint-module.cjs`) detects a silent skip (the gate neither
+  firing a card nor stating a default) and warns, never blocks, never re-fires the gate itself.
+  A systemic sweep of methodology skills for the same loose-description auto-fire bypass that
+  let `trending-to-absurd` reach for itself on a casual remark before its 2026-06-24 fix found
+  and closed 3 trivial instances inline (`MOSDeckEngine`, `client-discovery-interview`,
+  `mullins-scaffold`), with the rest reported and explicitly deferred. A scripted regression
+  test (`tests/test-227-frontdoor-restraint.cjs`) now proves the front-door restraint fix holds
+  without needing a live human tester re-run. `skills/larry-personality/SKILL.md` names ignite
+  for the first time and documents the gate's timing with real Hooked-Model (Fogg B=MAP / TARI)
+  reasoning: the gate is a Prompt, not an Investment, fired only when the navigator's opener
+  does not already signal a lane. `conversation-mode`'s Mode 3 (Build a Room) now routes through
+  ignite's Directive/`--express` path instead of calling `/mos:new-project` directly, correctly
+  reserving Gate B1's four-door persona pick for sessions that genuinely have not yet
+  established a role or venture. Same-day code review (independently re-verified, not
+  self-certified) caught and fixed two real defects before this landed: Mode 3's routing text
+  originally claimed established context unconditionally even on a cold direct pick with zero
+  prior exchange, and the mode-select "card-fired" recorder was wired against text no live code
+  path actually renders through `pickShape()`. Both closed at the design level in this same
+  pass (independently re-verified: 8/8 + 4/4 tests pass, both diffs re-read after landing),
+  not patched around the symptom.
+
+- **Phase 229: HUJI Pitch Feedback Module (IN PROGRESS, 8/9 plans -- not yet shipped).**
+  MindrianOS's first paying job: turn each student's diarized 5-minute pitch transcript into
+  one Minto-structured formative feedback artifact, batch-orchestrated across 200+ submissions
+  at a $4-5/unit cost ceiling, local-only scoring (Brain read-only, generic handles per Canon
+  Part 8). Built so far: the evidence/feedback zod schemas plus generated JSON Schema
+  (`229-01`); a labeled test-inventory harness and `run-all-229.sh` aggregator (`229-02`);
+  deterministic code checks covering quote verification, recall, drift, schema validation,
+  similarity, cost, and Part-8 hygiene (`229-03`); the `PWS_grading` recipe with a
+  score-and-continue rubric (`229-04`); a Stage A intake adapter porting the Claims-Aware
+  Fusion Mode A pipeline (`229-05`); an LLM judge spawner with a calibration protocol that
+  fails closed below a 0.7 anchor-hygiene bar (`229-06`); and a single-submission runner plus
+  batch orchestrator with pool/ledger/resume/retry and G1-G6 per-unit guardrails (`229-07`,
+  `229-08`). Not yet shipped: `229-09`, the mandatory demo run and human verdict checkpoint
+  this whole pipeline is gated on before any real submission gets scored -- per this project's
+  own standing rule, judge accuracy and calibration are a human-verify bar, never
+  self-certified.
+
+## [1.15.3-beta.24] - 2026-07-16
+
+### Added
+- No discrete feature completed exactly at this tag. This pre-release snapshot captured
+  in-progress work on Phase 227 (the mode-select firing checkpoint, sweep, and Mode 3 routing
+  work) and Phase 229 (the HUJI Pitch Feedback Module's Stage A intake adapter) mid-flight,
+  neither phase-complete at cut time. Phase 227's full, finished feature set is recorded once
+  under `[Unreleased]` above rather than split and duplicated across the interim tags it
+  happened to span.
+
+## [1.15.3-beta.22] - 2026-07-16
+
+### Added
+- No discrete feature completed exactly at this tag either, for the same reason as beta.24:
+  a pre-release snapshot mid-flight through Phase 227 (the skill-description sweep landed
+  here) and Phase 229 (PWS_grading recipe + score-and-continue rubric work).
+
+## [1.15.3-beta.20] - 2026-07-16
+
+### Added
+- **Backfilled here (this changelog under-documented this tag at cut time): five phases that
+  actually shipped in this release window.**
+  - **Phase 222 (reach-ranking-unification).** The three surfaces that suggest a next move
+    (`/mos:suggest-next`, the reach-candidates list, and the auto-fire engine) now always
+    agree on the top pick instead of occasionally diverging, and the ranking improves over
+    a room's own accept/reject history rather than staying static.
+  - **Phase 223 (jtbd-driven-intelligence-pipeline, governed bono).** `/mos:bono` is now an
+    8-phase governed research debate with Six-Thinking-Hats-style scrutiny (the Black hat
+    must disconfirm first, the White hat must cite-or-retract) and three explicit navigator
+    approval pauses (topic, hypothesis, ruling) instead of one collapsed confirmation. New
+    `/mos:intel-pipeline` command runs a staged research pipeline oriented on the room's
+    active JTBD (calibrate -> decompose -> fan out -> compute -> synthesize -> close), pausing
+    for approval twice and disclosing a thin fan-out pass rather than silently proceeding.
+  - **Phase 224 (graph-derivation-harness, SEED-034).** Every markdown write to a room now
+    enqueues and background-derives typed graph edges, closing the previously twice-reconfirmed
+    0-typed-edge gap on the write path -- no manual "derive" step required.
+  - **Phase 225 (per-session-room-binding, SEED-039).** Session-to-room binding now correctly
+    supports multi-room binds. Fixed during code review: a binding answer was silently
+    collapsing a multi-room selection down to a single room regardless of what was picked.
+  - **Phase 226 (eureka-reasoning-mode-fallback, SEED-058).** When the local embedding encoder
+    is unavailable, `/mos:eureka` now degrades to a labeled, lower-confidence REASONING MODE
+    result (a real short ranked list with an honest caveat naming the degrade cause) instead of
+    a hard `pairs_scored: 0` dead end. `banked` is structurally `false` on every reasoning-mode
+    row; a later healthy re-run over the same room surfaces the reasoning-to-embedded delta
+    instead of silently replacing the earlier result. Same-day code review found and fixed
+    three real data-loss edge cases in the upgrade-delta path before this shipped (a repeated
+    degrade could silently overwrite a completed reasoning report with no trace; a stale
+    session file could let a later healthy run get clobbered; reseeding could silently orphan
+    an in-progress judging session).
+- **Eureka entity extraction gets a two-tier WHAT-vs-WHY classifier.** A free, fully local
+  embedding pass (`lib/core/eureka/embedding-classifier.cjs`) now resolves the confident
+  majority of candidates at zero API spend, reusing the same encoder Eureka's own ranking
+  already depends on. The existing LLM classifier is demoted to an escalation-only path,
+  called per artifact only for the genuinely ambiguous residual the embedding tier cannot
+  confidently place. Measured on a real room: 61.1% of candidates resolve locally and
+  correctly, 14.3% fewer artifact-level LLM calls. Honest degrade throughout: no LLM key
+  means a disclosed low-confidence embedding best-guess, never a silent default; `classifier_source`
+  now reports `embedding` / `model` / `mixed` / `fallback` so every result states which tier
+  produced it. Tunable via `MINDRIAN_WHATWHY_MARGIN` (default 0.10, calibrated against a
+  measured holdout set). (Quick task 260714-k44.)
+
+### Fixed
+- **A low-confidence WHY term is no longer structurally indistinguishable from a confident one.**
+  When Eureka's two-tier classifier places a candidate as a framework (WHY) term but has no
+  working LLM to confirm the low-margin embedding best-guess, the term lands in the artifact's
+  `framework_terms` prop. The only trace that the guess was low-confidence lived in the aggregate
+  `status.json` counter (`tier2_low_confidence`); once written onto the node, the guess looked
+  exactly like a confidently-resolved term. Each term that lands via the no-LLM degrade path is
+  now disclosed per-term in an additive `framework_terms_low_confidence` sibling prop (always a
+  subset of `framework_terms`); a confident later run removes the marker; and existing readers of
+  `framework_terms`, which stays a plain comma-joined scalar, are unaffected. The 219 metadata
+  test now pins the disclosure so it cannot silently disappear. Caught live by the run-all-221
+  regression chain. (Quick task 260715-cu8.)
+- **Eureka's ranked top-25 no longer refills with scaffold pairs when real entities are thin.**
+  Every room stores one `memory_artifact` node per file as document scaffolding. When a room's
+  real-entity cohort is thin, those scaffolding nodes were pairing with each other and flooding
+  the ranked top-25 with `memory_artifact`-vs-`memory_artifact` pairs that carry no cross-domain
+  signal (measured at 72.0 percent of the top-25 on a live room once entity extraction correctly
+  thinned the entity population). Scaffold-vs-scaffold pairs are now excluded from the ranked-pair
+  candidate set by construction, at the point the candidate list is built, so the structural share
+  drops to 0.0 percent on the same live substrate regardless of how sparse the real entities are.
+  The exclusions are counted honestly in the report provenance (`scaffold_pairs_excluded`, in both
+  the JSON and the markdown table), never silently dropped. Pairs with only ONE scaffolding side
+  are unaffected, so a real entity paired with the artifact it came from still ranks. (Quick task
+  260715-0nj.)
+- **Eureka's entity-extraction pre-step no longer fails silently.** `/mos:eureka run`'s
+  auto-extraction step (shipped in beta.18) could fail (a thrown error, or the more likely
+  internally-caught non-zero return) with zero visible trace: exit 0, status `done`, nothing
+  in the report to say extraction never actually populated the graph. This reproduced the
+  exact false-success shape found in a live intern QA session. Failures on both paths now
+  surface as an additive `extraction_error` field in the eureka status.json plus one stderr
+  line; ranking, fallback behavior, and exit codes are unchanged (the degrade-never-throw
+  contract stays intact, only the silence is gone). Proven via a RED-then-GREEN reproduction
+  test wired into the permanent suite. (Quick task 260714-jjm.)
+
+## [1.15.3-beta.18] - 2026-07-13
+
+### Added
+- 
+
+## [1.15.3-beta.16] - 2026-07-13
+
+### Added
+- **Opportunity follow-through: surfaced opportunities stop dying as files and one-liners.**
+  Every opportunity now flows through the Harvest Formula lifecycle (candidate -> qualified ->
+  explored -> promoted | parked | retired) as a real graph node with append-only stage history -
+  who advanced it, why, and on what evidence, at every step.
+- **Eureka statements now bank as proposed opportunity nodes.** The portfolio scan's ranked
+  statements get a REAL awaited Grounding Guard verdict (a bounded async resolution pass over
+  the Phase 212 critic - previously the sync emitter could never await it, so nothing ever
+  banked on a live run). Statements the critic passes bank as `opportunity` nodes with
+  DERIVED_FROM evidence edges; statements it rejects stay honestly unbanked with the verdict
+  named. Tunable via `MINDRIAN_OPPORTUNITY_BANK_PREDICATE` (critic | critic+tail | all).
+- **Harvest sensor (SENS-14): graph events become scored opportunity candidates.** A producer
+  on the insight-sensor rail harvests candidates from five lanes (eureka proposals, bridges,
+  contradictions, whitespace, meeting filings), classifies each through the Gibson Four-Lens
+  (leveraging_resources / challenging_orthodoxies / understanding_needs / harnessing_trends),
+  and scores them with HarvestIndex_v1. The bridge lane rides the real extraction edge
+  vocabulary (COMPETES_WITH / USES_COMPONENT / SUPPLIES_TO), so it finds genuine cross-entity
+  signal on real rooms, not just fixture edges.
+- **Qualification Decision Gate (`/mos:qualify-opportunity`).** Harvested candidates come to
+  YOU at a real card showing why each one qualified (Q1..Q8 rubric verdicts + machine-readiness
+  components; an unknown is typed `unknown`, never a fabricated zero). Five verbs:
+  Qualify+file, Park, Retire, Explore, Skip. A Skip writes a typed REJECTED_BECAUSE edge -
+  rejection is data the ranker learns from. Nothing qualifies without your explicit verb.
+- **[Explore]: one explicit action turns a qualified opportunity into deep research**
+  (`/mos:explore-opportunity`). Runs the explored-stage chain - deep research, diffusion and
+  timing, analogies, web validation - and files a Minto-shaped opportunity artifact (governing
+  thought + SCQA + cited sources) into `opportunity-bank/` plus a research corpus artifact into
+  `research/`, both through the navigation.cjs gates with typed evidence edges. When the
+  engine cannot run, the surface OFFERS an LLM manual fallback at a card - honestly labeled
+  `engine_mode: llm_manual_baseline`, never silent, never the default.
+- **Frontmatter metadata extraction slice.** Artifact frontmatter (methodology, status,
+  created) now lands as graph properties during extraction, so engines reason over what the
+  files already declare.
+- **Web ingestion agent: any URL becomes room knowledge in one governed move.** Paste a link
+  in conversation, or run `/mos:research <url>`, and after you approve at the card the page
+  is fetched (Tavily Extract, server-side clean markdown), filed as a cited research artifact
+  in `research/` (source URL, capture date, content hash, review status: proposed), and its
+  entities land in the room graph so every engine can use them. Nothing is ever fetched or
+  filed without your explicit verb ([Ingest] [Ingest+Explore] [Skip]).
+- **Pasted-URL sensor (SENS-15).** A bare URL in your turn offers an ingest card
+  contextually - it never auto-files, and it stays quiet for URLs inside code blocks,
+  quotes, or ones the room already ingested.
+- **Content-hash idempotency + SUPERSEDES versioning.** Re-ingesting an unchanged page is an
+  honest no-op; a changed page files a NEW version linked to the prior one - history is
+  append-only, nothing is overwritten.
+- **Watched sources: crawl-and-learn on cadence.** Register sources in
+  `.mindrian/watched-sources.json` and the scout cadence re-ingests changed pages under a
+  per-run cap (default 2), with cadence provenance stamped on every artifact. Findings
+  surface as candidates at existing gates - never auto-qualified.
+- **Provider honesty everywhere (research_mode envelope).** Every ingest and research run
+  names which provider produced the bytes (tavily-extract / webfetch / manual), which mode
+  it ran in (normal / web_degraded_local_fallback / local_only / insufficient_evidence),
+  and never reports success with empty results. A failed fetch is a typed refusal, not a
+  silent empty.
+- **Part 8 + inbound safety on the new surface.** Outbound carries the URL only through the
+  audited egress chokepoint; inbound web content is data end to end (prompt-injection
+  inert, size-bounded, path-safe filing, no symlink escape), adversarially test-pinned.
+- **Every research/recovery stage now produces a typed envelope instead of guessing from an
+  empty result.** `lib/core/recovery/stage-envelope.cjs` gives all 13 pipeline stages
+  (retrieval, discovery, filing, and more) one shared shape: status (ok / empty_valid /
+  degraded / failed / blocked), a named failure_class from a frozen 13-class vocabulary,
+  retryable, provenance, and timestamps. A zero-result stage and a broken stage used to look
+  identical (both "empty"); now they carry different, typed reasons, and a validator enforces
+  the pairing rules (a failed/blocked stage MUST name its class; an ok stage MUST NOT).
+- **When a research engine breaks, Mindrian now recovers through a real 6-tier ladder instead
+  of just failing.** `dispatchRecovery` reads the typed envelopes and tries, in order: (0)
+  nothing wrong, (1) one bounded idempotent retry for a transient failure, (2) a local
+  governed substitute (your room's own corpus, or its cache, honestly labeled - never "live"
+  when it isn't), (3) an OFFERED high-effort LLM recovery pass at a Decision Gate (never
+  silent, never the default), (4) naming the smallest missing thing a human needs to fix (a
+  credential, an engine), (5) honest termination when nothing worked - a partial result
+  naming exactly which engines are still down, never a complete-looking bundle papering over
+  a gap.
+- **Running out of Claude spend mid-recovery is now its own honestly-named failure, not a
+  retry loop.** `spend_limit_exceeded` is a structural, first-class failure_class: it forces
+  `retryable:false` at the moment the envelope is built (not just checked later), and
+  short-circuits straight past every retry/substitute/LLM-recovery tier to a plain human
+  message: "raise your limit at claude.ai/settings/usage, or wait for the monthly reset."
+  This closes a real gap this exact session hit: four parallel agents stalling out on an
+  account spend cap, with no honest way for the system to say so.
+- **The high-effort LLM recovery pass runs through a 7-step, resumable, audited case file,
+  never a black box.** A gate-offered recovery run (diagnose -> plan -> execute -> validate
+  -> reconcile -> resume -> surface) journals every step to a real case file under
+  `.mindrian/recovery/<run_id>/` so a crash mid-run resumes exactly where it left off, never
+  re-doing completed steps. Five hard fences, each proven by an adversarial test: the
+  Brain-egress boundary can't be weakened from inside a recovery run, an unknown component
+  can never be silently upgraded to "supported," every write still goes through the one real
+  writer (no raw DB access from a recovery hook), a filing is only ever called "recovered" if
+  a readback actually confirms it landed, and hostile text embedded in a source (a fake
+  instruction, a fake tool call) is always treated as inert data, never executed.
+- **Recovery outcomes are now honestly composed, never inferred.** `composeRecoveryResult`
+  derives one of five outcomes (recovered / partial_recovery / degraded_recovery /
+  manual_intervention_required / insufficient_evidence) strictly from what actually happened:
+  "recovered" requires every stage envelope to validate AND any attempted filing to be
+  readback-confirmed - one unconfirmed filing forces `partial_recovery`, never a false
+  "recovered." The result rides as an additive `research_mode` + disclosure field on every
+  touched surface (research, opportunity exploration, URL ingestion) without changing any
+  existing field's meaning.
+- **A gap in one accessible corpus is never reported as "this doesn't exist."** The
+  vantage-error lesson from this exact release wave (an external research pass wrongly
+  concluded a shipped phase was "missing" because it only checked one gitignored, unpushed
+  corpus) is now a structural, permanent rule: the only gap scope the recovery composer can
+  ever emit is `corpus` (a provisional, vantage-scoped gap), never `project` (a claim of
+  project-level nonexistence) - enforced by a source scan that fails the build if that ever
+  changes, plus a permanent regression fixture that encodes this exact mistake so it can
+  never silently return.
+- **14-class recovery matrix, offline and permanent.** Every named failure class (network
+  timeout, missing credential, contract violation, policy block, cadence-vs-on-demand,
+  multi-engine outage, spend limit, vantage-scoped gap, and more) is asserted end to end
+  through the real dispatch and controller seams, with zero network calls - two of the
+  fourteen (the vantage rule and spend_limit_exceeded) are locked as PERMANENT fixtures
+  precisely because this session discovered both the hard way.
+
+### Fixed
+- **Windows FTS5 crash: eureka degrades bi-modal instead of dying.** On machines whose Node
+  SQLite lacks the FTS5 module, the tri-modal index used to crash the whole scan with
+  `no such module: fts5`. A capability probe now selects the backend up front: with FTS5 the
+  lexical leg runs as before; without it the scan runs honestly on the two remaining legs
+  (vector + graph) and stamps `fts_backend: absent (bi-modal degrade)` in provenance. Never a
+  crash, never a silent lie. Live-validated on the exact Windows machine that exposed the bug
+  (corepower-isolation, 219-VERIFICATION.md Section 4).
+
+## [1.15.3-beta.14] - 2026-07-12
+
+### Added
+- 
+
+### Fixed
+- **The card-fire backstop no longer force-fires on benign numbered lists** (`scripts/check-card-fire.cjs`). The `ASCII_BOX_GLYPH_RE` alternative-4 shape (a bare `1. / 2.` numbered-prose list, added Phase 209-07) matched ANY 2+-item list on shape alone, so an ordinary Action Footer or a step-by-step explanation that shared any incidental vocabulary with the user's turn was misread as an unfired Decision Gate and hard-blocked. New `GATE_FRAMING_RE` co-requirement (CR-05): a bare numbered-prose list counts as a backstop hit ONLY when a choice-framing cue (`?`, or one of `which / would you like / pick / choose / select / type 1`) sits inside the matched span or the ~150 chars before it. Alternatives 1-3 (bracket notation, the `type 1, 2, or 3` literal, the multiline bracket box) stay unconditional, and `ASCII_BOX_GLYPH_RE` itself is byte-identical so the retry-key signature and the Phase 209 regex-matrix tests are untouched. The Phase 209 floor survives: a genuine hand-rolled fork carrying a framing cue still intercepts.
+- **The Stop-hook `reason` slug no longer reaches the user as a fake "Stop hook error"** (`scripts/check-card-fire.cjs`, `buildEnforcementEnvelope`). The 2026-07-05 fix added a `systemMessage` on the premise that Claude Code surfaces `reason` as "Stop hook error: <reason>" ONLY when no `systemMessage` is present; live observation proved that premise FALSE (it renders `reason` regardless). The only lever is the `reason` CONTENT, so it is now a calm, human-safe phrase on BOTH the intercept and degrade branches (CR-06), never the internal slug. The slug is preserved for telemetry, relocated to the new local diagnostic log (below), not deleted. Confirmed `turnContextHash` never reads `reason`, so the bounded-escape retry key is unaffected (asserted by a new non-effect test).
+- **New local-only intercept diagnostic log** (`~/.mindrian/card-fire-intercepts.log`, CR-07). Append-only JSONL written whenever the backstop intercepts or degrades, capturing `{ timestamp, session_id, reason (the ORIGINAL slug), gate_signature, ran_entries, matched_glyph_span, output_text (truncated ~4000 chars) }`. TTL-pruned on every write by the same `RETRY_TTL_MS` the retry side-file uses, so it cannot grow unbounded. Canon Part 8: LOCAL disk only (`~/.mindrian`), never the Brain, never a network wire. This turns the still-open "unexplained backstop trigger" mystery (`live-session-running-stale-plugin-cache-fixes-inert`) into a one-log-read diagnosis on its next occurrence.
+- **`check-card-fire.cjs`'s `gate-is-simple-binary` exemption swallowed genuine two-option forced-choice forks, not just yes/no closers.** The exemption (added 2026-07-05 to stop over-firing on trivial binaries like "Want those?") used a bare `gateLabels.length === 2` cardinality check, which cannot distinguish that from a genuine two-way strategic fork ("run research vs build the plan"). An intern QA session missed 3 such forks in one session because each carried exactly 2 option labels. Now requires the labels to be YES/NO-SHAPED (new `lib/core/gate-relevance.cjs::isYesNoShapedGate`, extracted from `gateAlreadyAnswered`'s existing yes/no answer-matching), not merely 2-in-number, so a real yes/no closer stays exempt while a genuine 2-option fork force-fires like a 3+-way one. Post-merge integration fix: `GATE_FRAMING_RE` widened with a cardinality + choice-noun cue ("two options", "3 paths") so a fork phrased without a literal `?`/`which`/`pick` still force-fires, closing a gap CR-05 would otherwise have silently reopened. `.planning/debug/intern-w1-card-discipline-decay.md`.
+- **MCP `room_state` reads re-resolve the active room per call, same as `room_content` writes** (`lib/mcp/tool-router.cjs`). The `status` / `analyze` / `compute-state` / `get-state` / `suggest-next` branches read the boot-time closure `roomDir` directly, so a mid-session room switch (or a room created after the MCP daemon booted) was invisible to them and `status` falsely reported "No room initialized" against a room with real content. Now reuses the same `resolveWriteTargetDir` resolver the beta.12 `room_content` write fix already proved correct. intern-w1-room-state-false-empty.
+- **`intelligence:research` now actually fetches instead of echoing its own command spec** (`lib/mcp/tool-router.cjs`). The `research` sub-command fell through to the generic `buildContext()` doc+state-echo helper (the same fallback reasoning-only ops like `grade`/`whitespace` correctly use), so it deterministically returned `commands/research.md`'s own frontmatter and spec text for any input, with zero web fetch. Now special-cases `research` to invoke `research-context-extractor.cjs` -> `source-lens-driver.cjs` (Stage 1-4) and return real findings with source/url/evidence-tier; filing (Stage 6-7) stays a human decision per Canon Part 9 role 5, never auto-wired inside a single MCP call. `commands/mva-brief.md` (the only other `reach_id: deep_research` command) checked and confirmed unaffected -- it runs its own Bash script, not this tool. intern-w1-research-reach-broken.
+- **STATE.md is now actually recomputed after a room-section write, not just reported as recomputed** (`lib/core/intelligence-cascade.cjs`, `lib/core/state-ops.cjs`). `scripts/compute-state` only prints the STATE.md body to stdout by design; it never writes the file itself, so every caller owns persistence. The automatic PostToolUse cascade (Step 8) and the MCP `room_state compute-state` command both discarded that stdout while reporting/implying success, so a filed artifact never updated the room's own intelligence layer in the same turn it was filed. Cascade Step 8 now captures and persists the stdout directly; `state-ops.cjs::computeState()` now persists at the single Node chokepoint, mirroring the pattern already correct in `scripts/on-stop` / `on-task-complete` / `on-agent-complete`. intern-w1-state-not-recomputed.
+- **The session-start mode-selection Decision Gate (`skills/conversation-mode/SKILL.md`) can silently skip with zero detectable signal** (RCA `intern-w1-mode-gate-skip`). Root cause: two converging structural gaps. (1) `scripts/build-render-coverage.cjs::buildMdKeyspace()` walked only `commands/*.md`, never `skills/*/SKILL.md`, so a skill-declared `hitl_shape` Decision Gate could never register in `data/render-coverage-registry.json` -- PRIMARY detection was structurally blind to every skill-declared gate. New `buildSkillKeyspace()` (a third, additive registry keyspace, mirroring the existing commands walk) closes this; `skills/conversation-mode/SKILL.md` now registers as `declared_shape: F.1, wired: true`. (2) `scripts/check-shape-declaration.cjs` had no predicate catching a surface that self-declares BOTH a genuine `hitl_shape` fork AND `connector.excluded:true` (the no-fork exemption) at once -- a direct contradiction of this repo's own CLAUDE.md Part 11 text: "a render-only or pure-capability skill is exempt via its existing connector.excluded:true + reason, never via a fork it does not have." A new predicate now WARNs (advisory, non-blocking per the existing Phase 210 policy) on this exact contradiction. Extending PRIMARY detection to skills also surfaced 5 pre-existing, previously-invisible unwired skill declarations (`MOSDeckEngine`, `client-discovery-interview`, `intelligence-orchestrator`, `mullins-scaffold`, `mva-pipeline`) and 54 additional pre-existing hasShape-and-excluded contradictions beyond conversation-mode -- both are real, tracked findings surfaced for the first time by this fix, out of scope to resolve here, and named in `tests/test-209-declared-implies-wired.cjs`. `scripts/check-card-fire.cjs` (the Stop-hook backstop, the third converging gap in the original RCA) is untouched by this fix.
+- **11 SKILL.md files documented `bash scripts/<name>` as if `scripts/` were skill-local** (`skills/rooms`, `publish`, `new-project`, `setup`, `room`, `file-meeting`, `wiki`, `vault`, `ingest-methodology`, `ignite`, `export`, plus `commands/new-project.md`). The scripts only ever existed at the plugin root, so any invocation with cwd != plugin root failed exit 127. Prefixed all 72 call sites with `${CLAUDE_PLUGIN_ROOT}` (quoted), the proven convention already used in ~38 other SKILL.md files, `hooks.json`, and `.mcp.json`. Also removed the co-located `PLUGIN_ROOT="$(dirname "$(dirname "$(readlink -f "$0")")")"` pattern (`skills/rooms/SKILL.md` Step 2.5, `skills/new-project/SKILL.md`, `commands/new-project.md`, referenced by `skills/ignite/SKILL.md`) -- confirmed broken under the Bash tool's actual invocation mechanism (`$0` resolves to the shell binary, computing `/usr` as the plugin root on every call) -- replaced with `${CLAUDE_PLUGIN_ROOT}` throughout. See `.planning/debug/intern-w1-rooms-skill-script-path.md`.
+- **`/mos:rooms new` could silently fail to create a room while narrating success.** `scripts/resolve-room`'s legacy-fallback branch returned the pre-existing `room/` path with exit 0 (success) whether or not a new room was actually registered, indistinguishable from a real registry hit -- the direct mechanism behind a false "Room's live" claim when no `cv-project/` directory or registry entry ever existed. Added a `--strict` mode: a bare legacy fallback (no `--adopt`) now prints a `FALLBACK:` stdout marker and exits 2, never 0 -- fully backward compatible for every existing caller that omits the flag. Also tightened `skills/rooms/SKILL.md` Step 2's legacy-room adoption prompt to the same "FIRE THE CARD -- mandatory" doctrine `/mos:ignite`'s B1/B2 gates carry, added an explicit warning against narrating room creation before `birthRoom()` returns `{ok:true}`, and fixed the routing note that mislabeled Step 2 as "(name/slug capture)" (Step 1 captures the name/slug; Step 2 is the adoption check). See `.planning/debug/resolved/intern-w1-rooms-new-silent-fail.md`.
+- **`/mos:doctor` Class H (`install-incomplete-module.cjs`) no longer false-positives "install incomplete" on a healthy one-command marketplace install.** Class H never received the `resolveActivePluginRoot()` topology-awareness fix Class A/Class I got in Phase 123 -- it only recognized a legacy `.install-receipt.json` or a user-level `statusLine` block as "healthy," neither of which a marketplace-cache install ever produces. Its `--fix` path then wrote a `~/.claude/settings.json` `statusLine` override pointing at the hardcoded legacy install path, which does not exist on a marketplace-cache-only machine -- silently breaking the statusline for the rest of the session (user-level settings override plugin-level; the broken exec never surfaced an error in chat). Class H now checks topology first and reports healthy without touching the legacy signals. `statusline-visibility-module.cjs` (Class G) also now tests the EFFECTIVE resolved statusline command (the user-level override if present, else the plugin's own), not always the plugin's own file, so the self-heal's re-verification can actually catch a broken override instead of reporting "ok" regardless. The SessionStart self-heal's outer timeout (`scripts/check-onboard-statusline.cjs`) is raised from 4000ms to 10000ms to clear its own nested worst-case spawn budget (8000ms) instead of getting killed mid-repair. Fix re-implemented against the post-Phase-217 `lib/core/doctor/*-module.cjs` files (the original worktree's fix predated that migration). RCA: `.planning/debug/resolved/intern-w1-statusline-room-mismatch.md`.
+
+## [1.15.3-beta.12] - 2026-07-06
+
+### Added
+- **Phase 211 Eureka generator now runs at production scale.** The tri-modal room.db retrieval engine (FTS5 lexical + sqlite-vec vector + RRF fusion, `mdbr-leaf-ir` local embedder) completes end-to-end against a real 2117-node room after two blocker fixes (below). This is the GENERATOR half of the "two-in-a-box"; the critic (Phase 212) is planned, not yet shipped.
+- **Generic `csv-to-idea-graph` export capability** (`scripts/csv-to-idea-graph.cjs`). Turns any relationship CSV (a pairs edge-list plus optional node-enrichment CSV, column-mapped via CLI args) into a De Stijl navigable idea-graph through the shipped dashboard template -- Section-clustered by a chosen grouping column, layer-toggled, every node/edge citation-tagged. Extends the `generate-standalone` export family; zero tenant hardcoding. Hermetic `tests/test-csv-to-idea-graph.cjs` 21/21.
+
+### Fixed
+- **MCP `room_content` writes re-resolve the active room per call** (`lib/mcp/tool-router.cjs`). The MCP server froze its write target at boot-time cwd, so a mid-session `room-registry set-active` never reached it and writes (file-opportunity / create-funding / update-funding-stage) misrouted to the spawn-time room. Now each write branch calls `resolve-active-room.cjs` (the canonical resolver -- this was a fifth active-room guesser never migrated onto it, the exact stale-closure class Phase 212 D5 warns against). Also aligned `opportunitySchema` to `fileOpportunity` (title optional with a title-or-program refine, coerced numerics). Commit `7a84d38b`.
+- **Strict-mode no longer fires false room-switch / session-binding gates** (`lib/core/room-classifier-strict-mode.cjs`, `scripts/intent-classifier.cjs`). A bare numeric menu reply (`NUMERIC_PATTERN` made the verb optional) and product-branded paste blocks (brand tokens credited as room-name matches) both triggered spurious "switch rooms" / "bind session" interruptions on nearly every turn. Verb now required; brand/boilerplate stop-set excluded from name-entity credit. Commit `e23060cd`.
+- **`birthRoom` binds the newborn room into the session write scope** (`lib/core/navigation/room-birth.cjs`). It flipped only the registry active pointer; Phase 194 (PSB) made the per-session bound SET the primary write authority, so a just-created room was BLOCKED for writes. Now unions the new slug into the session binding as primary via the shipped `session-binding.cjs`; `ignite` threads the real `CLAUDE_SESSION_ID`. Commit `3ad78e70`.
+- **Frontmatter schema validator reconciled to the actual writers** (`lib/core/frontmatter-schemas.cjs`). The Phase 88.1-07 schema codified an aspirational vocabulary no scaffold/doc/compute-state writer ever emitted, so the plugin's own output failed its own advisory schema (a Canon Part 6 dog-food self-violation) and polluted the offense log. Relaxed ROOM.md/STATE.md/artifact-default required sets to what writers emit, added a USER.md schema, and split violation messages into missing-vs-unexpected. New reconcile test scaffolds a room and asserts zero blocking violations. Commit `2602c65b`.
+- **Embedding OOM on large-N rooms** (`lib/core/eureka/embedding-spine.cjs`): `embedTexts` embedded the whole corpus in one forward pass (~26.7GB ONNX allocation on 2117 nodes). Now batched (`MINDRIAN_EMBED_BATCH`, default 32). Commit `c222ff7d`.
+- **vec0 offline-load failure** (`lib/core/eureka/vector-store.cjs`): the backend was inferred from stale table existence, so a table from a prior run threw `no such module: vec0`. Now a per-process capability probe selects the backend; confirmed sqlite-vec loads on Node 22 via a `better-sqlite3` allowExtension handle (the >=23.5 floor is `node:sqlite`-only). Commit `73698c73`.
+- **Claim-text persistence + read-side fallbacks** (D15): `writeClaimNode` persists claim `text`; tri-modal index read-side fallbacks for claim/WhitespaceZone/Artifact. Commits `3d1b27a4`, `af24b697`.
+- **`.gitignore` room.db patterns** backing the "never commit room.db" comment (Part 8 hygiene). Commit `a4cd48dc`.
+
+### Housekeeping
+- **JHTV tenant data + JHU-specific tooling relocated out of the product** into the `jhtv-oliver-kuntz` room, with a `.gitignore` leak guard (Canon three-layer: tenant data/tooling lives in the Room, never the Plugin). The reusable graph capability was generalized (see Added). Commit `57bad7ed`.
+- **Planning (not shipped code):** Phases 212 (Eureka Grounding Guard critic, 5 plans), 212.5 (graph substrate), 213-215 (15 checked plans total) and SEED-053 (methodology-chain MCP tool) registered for the next arc. 213/214 execution is gated on the curing-track verdict + 212-05 calibration.
+
+## [1.15.3-beta.10] - 2026-07-05
+
+### Added
+- **Ratification-tracked next-actions now surface in the statusline's `Next:` slot.** Quick task 260705-ui4, motivated by the rethinking-mindrianos standing-consultant room's own unconverted research entries (`ratification_status: proposed` frontmatter) going invisible once the routing engine had nothing else to offer. Reuses the existing `next-move-cache` mechanism end to end (Canon Part 7: no second cache) -- new `lib/statusline/ratification-next.cjs` resolves the active room FRESH per call (avoiding the frozen-roomDir staleness class found at `bin/mindrian-mcp-server.cjs:65`), shallow-scans `research/*/` for `ratification_status: proposed`, and returns an enum/count-only cue (`ratify strong (2 open)`, never entry titles or target prose -- Canon Part 8). `persistFromDecision(decision, opts)` gained an opt-in `opts.fallbackProvider` on the case-3 clear leg only; no-opts behavior stays byte-identical, so the existing clear-semantics tests are unmodified. The statusline's context-percentage color contract (50/65/80 thresholds) and risk chip are untouched -- the `Next:` segment itself carries zero color/ANSI treatment, so the new cue needed none. New tests/test-statusline-ratification-next.cjs 12/12; context-aware 19/19 unmodified; live-signals 10/10.
+
+## [1.15.3-beta.8] - 2026-07-05
+
+### Added
+- **JTBD-driven regroup of the 11 `/mos:help` families** (refines the beta.6 3-card selector, not a redesign). Every family's membership is now traceable to a coherent Jobs-To-Be-Done outcome instead of ad-hoc navigational grouping: filled the 2 missing `serves_jtbd` tags (`ingest-methodology`, `stance`), reassigned 9 commands across 3 JTBD-coherent moves, renamed `frame-the-problem` to "Frame & Validate", and gave every family an explicit `jtbd: []` declaration. `scripts/check-help-coverage.cjs` now permanently machine-enforces this coherence (new `jtbd_missing_declaration` / `jtbd_unknown_tag` / `jtbd_incoherent` checks, vocabulary enumerated from disk) so the map can't silently drift back into vibes-based grouping.
+- **Staleness-prevention for the commands/-to-skills/ mirror workaround.** `scripts/build-skill-mirrors.cjs --check` is now wired into pre-commit (tracked + installed hook), `scripts/verify-release` (new step 10b), and `doctor --acceptance` (folded into the existing coverage-gate point), so a future `commands/*.md` edit can never again silently strand a stale `skills/<name>/SKILL.md` mirror. Also hardened `--check` to verify the hand-authored `trending-to-absurd` skill stays present and genuinely divergent from its command. The new gate immediately caught and fixed 3 real stale mirrors left over from the JTBD regroup on its first run.
+
+## [1.15.3-beta.6] - 2026-07-05
+
+### Added
+- **Every `/mos:` command is now also reachable via the `skills/` loading path** (`scripts/build-skill-mirrors.cjs`, new generator, write + `--check` modes). Root cause: on a confirmed-affected Windows Claude Code install, this plugin's `commands/*.md` files fail to register ("No commands match") while `skills/` and MCP-server prompts from the same plugin load fine -- reproduced identically on an unrelated marketplace plugin on the same machine, and confirmed against Anthropic's own docs (commands/ is the legacy flat-file path; skills/ is the recommended one). `commands/*.md` stays the single, untouched source of truth -- this repo's own command-registry/render-coverage/help-coverage tooling all read commands/ only. 105 new byte-identical `skills/<name>/SKILL.md` mirrors generated (106 with the pilot's `help`); `trending-to-absurd` skip-listed (pre-existing hand-authored skill already covers it). One documented, precedented field exception: wired commands' `connector.sensor_triggers` is rewritten to `[]` on the mirror only (61 of 105) to avoid a duplicate-tuple collision in `build-connector-registry.cjs` -- the same pattern the pre-existing `trending-to-absurd` skill already used for the identical reason.
+
+### Fixed
+- Unanchored `.gitignore` patterns (`room/`, `export/`) were also matching the new `skills/room/` and `skills/export/` mirror directories, silently dropping them from commits with no CIRS gate catching it (gates check filesystem presence, not git-tracking status). Anchored both to repo root.
+
+## [1.15.3-beta.4] - 2026-07-05
+
+### Fixed
+- **`vunknown` version banner on Windows, root-caused.** `session-start`'s `$PLUGIN_ROOT` was a git-bash MSYS path (`/c/Users/...`), which Windows-native `node.exe` cannot resolve inside `require()` -- every version-resolution call on that platform silently failed to `unknown`. Normalized once via `cygpath -m` (no-op on Linux/macOS) and threaded through all 8 call sites in the script that previously passed the raw path.
+- **`check-card-fire.cjs` (the SEED-021 Stop hook) leaked its internal classification slug to the user as a fake "error".** A `decision:'block'` envelope with no `systemMessage` renders its `reason` field as "Stop hook error: <slug>" even when the hook is working correctly. Added a calm, fixed `systemMessage` on the intercept branch; the slug stays in `reason` for logs.
+- **The same hook over-fired on plain binary (yes/no) closers**, forcing a card for simple confirmations the same as a genuine multi-option fork. New `gate-is-simple-binary` pass-reason exempts exact 2-option closers while preserving the Phase 209 floor for genuine 3+-way forks.
+- **`/mos:help`'s last stale-copy residual** ("in this lane", "four color-coded lanes") reworded to match the real 11-family / 3-card design shipped in beta.3.
+
+## [1.15.3-beta.3] - 2026-07-05
+
+### Added
+- **`doctor --report-registration-bug`** -- a new diagnostic mode for the confirmed Claude Code host-side command-registration bug (commands fail to register while skills/MCP prompts load fine, reproduced across unrelated plugins). Rules out every locally-checkable cause first (install-cache drift, silent-disable, legacy config-pin drift, marketplace-clone dirty state, version-of-record agreement) before assembling a paste-ready report for Anthropic. Never claims "fixed" -- diagnostic only.
+- **`lib/core/command-registration-check.cjs`** -- a precondition sweep (frontmatter fences, YAML tabs, legal command names, case-insensitive collisions, description length) wired into the new doctor mode, the release gate, and pre-commit.
+- **`/mos:help` reshaped** from a stale "4-lane" claim to the real 11 command families, rendered as 3 native `AskUserQuestion` cards (4+4+3) instead of one artificially-merged card.
+- **The legacy `config.json` version-pin drift (F11)** is now detected and auto-repaired by `doctor --fix` -- confirmed recurring twice on the same real Windows machine before this fix; two Windows-specific correctness bugs in the fix itself (a missing config.json schema variant, a Windows-illegal `:` in a backup filename) were also found and fixed the same day.
+- The cold-start banner's command count is now computed live instead of a hardcoded literal that had drifted stale (last read "45" against an actual 107).
+
 ## [1.15.3-beta.1] - 2026-07-03
 
 ### Changed

package/README.md

@@ -10,7 +10,7 @@
   Powered by PWS (Problems Worth Solving), an innovation methodology built and tested through 20 years of teaching by Prof. Lawrence Aronhime.
   Engineered by Jonathan Sagir.
 
-  [![Version](https://img.shields.io/badge/version-1.15.1--beta.1-1E3A6E)](CHANGELOG.md)
+  [![Version](https://img.shields.io/badge/version-1.15.3--beta.26-1E3A6E)](CHANGELOG.md)
   [![License](https://img.shields.io/badge/license-BSL_1.1-C8A43C)](LICENSE)
   [![Works on](https://img.shields.io/badge/CLI_+_Desktop_+_Cowork-2D6B4A)](#three-surfaces)
 
@@ -50,7 +50,7 @@ You talk; the room writes itself. Every conversation, every meeting, every decis
 
 ### The room surfaces what you cannot see
 
-Every time you add something new, the system compares it against everything already there. Larry tells you what just changed, what contradicts what, what connects to what, and what is now missing. You decide: APPROVE, REJECT (with a reason), or DEFER. The reason becomes part of the room. The next scan is smarter.
+Every time you add something new, the system compares it against everything already there. Larry tells you what just changed, what contradicts what, what connects to what, and what is now missing. You decide: APPROVE, REJECT (with a reason), or DEFER. The reason becomes part of the room. The next scan is smarter. When a scan surfaces an opportunity, it does not stop at a headline: you qualify it at a card, and one explicit Explore turns it into cited deep research filed in your opportunity bank. The web works the same way: paste a URL and, once you approve, the page is filed as a cited source in your room and compared against everything already there. When something breaks mid-research, it tells you exactly what happened and what it tried next, never a silent empty result.
 
 ---
 
@@ -121,12 +121,14 @@ The commands below are internals. You never have to memorize them or type them.
 /mos:bono                 # a six-hats research-and-debate team on your question
 /mos:map-unknowns         # hunt the claims you are most confident about, and wrong
 /mos:file-meeting         # paste a transcript, Larry files it
+/mos:research <url>       # paste a link, approve the card, the page becomes cited room knowledge
 /mos:opportunities        # what grants match this room right now
+/mos:qualify-opportunity  # judge a surfaced opportunity at a card; Explore turns it into research
 /mos:graph "what is the weakest assumption in my financial model?"
 /mos:grade                # honest assessment against real ventures
 ```
 
-That is a slice of 107 commands across 14 skills and 9 agents. If you do not know which one to run, that is the normal case. Just talk: Larry reaches for the right one.
+That is a slice of 111 commands across 124 skills and 9 agents. If you do not know which one to run, that is the normal case. Just talk: Larry reaches for the right one.
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mindrian_os/cli",
-  "version": "1.15.3-beta.3",
+  "version": "1.15.3-beta.30",
   "description": "Install MindrianOS into Claude Code with one command -- `npx @mindrian_os/cli`. Ships the MindrianOS plugin (Larry + PWS methodology + Data Room) plus a setup/diagnostics CLI (install/doctor/update).",
   "scripts": {
     "mcp": "node bin/mindrian-mcp-server.cjs",
@@ -19,6 +19,7 @@
     "CHANGELOG.md"
   ],
   "dependencies": {
+    "@huggingface/transformers": "^4.2.0",
     "@ig3/markdown-it-wikilinks": "^1.0.2",
     "@modelcontextprotocol/ext-apps": "^1.5.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
@@ -30,6 +31,7 @@
     "gray-matter": "^4.0.3",
     "markdown-it": "^14.1.0",
     "semver": "^7.7.4",
+    "sqlite-vec": "^0.1.9",
     "zod": "^3.25.76"
   },
   "engines": {