@mindrian_os/cli 1.15.3-beta.32 → 1.15.3-beta.36

package/CHANGELOG.md

@@ -1,3 +1,49 @@
+## [1.15.3-beta.36] - 2026-07-22
+
+### Fixed
+- **`room_bind` could never write a per-session room binding on stdio, so all CLI sessions
+  fell back to one shared, unlocked `registry.json` active-room field.** Root-caused via a
+  full RCA (`.planning/debug/resolved/registry-active-room-concurrent-session-collision.md`):
+  `writeSessionBinding` -- the only function that sets a session's own room binding -- has
+  exactly two call sites, both gated behind `room_bind`'s `effectiveSessionId` check, which
+  requires the MCP SDK's `extra.sessionId` (never populated on stdio) or an explicit
+  `sessionId` argument (nothing supplied one automatically). So no CLI session could ever
+  populate its own binding, and every session's write-target resolution fell through to a
+  single global field that multiple concurrent `claude` CLI processes on one machine then
+  raced to overwrite -- confirmed live with 4 concurrent sessions on this machine, one
+  session's active room silently clobbering another's. Fixed: `room_bind` now falls back to
+  `process.env.CLAUDE_CODE_SESSION_ID` as a third-priority session identifier on stdio
+  (precedence: explicit param > SDK `extra.sessionId` > `CLAUDE_CODE_SESSION_ID` >
+  `no_session_id`), so a CLI session can finally write a real per-session binding. The
+  separate F.8 binding-ambiguity-card logic in the same handler is untouched. New test:
+  `tests/test-room-bind-stdio-session-fallback.cjs` (4 assertions); all 21 pre-existing tests
+  touching `room_bind`/`tool-router.cjs`/`session-binding.cjs` still pass.
+- **`write-scope-check.cjs`'s own session-identity fallback checked the wrong environment
+  variable name.** It read `process.env.CLAUDE_SESSION_ID`, which this runtime never sets;
+  the real variable is `CLAUDE_CODE_SESSION_ID`. Fixed with a backward-compatible fallback
+  chain (`CLAUDE_CODE_SESSION_ID` first, legacy `CLAUDE_SESSION_ID` second) so existing test
+  fixtures that set the old name are unaffected. A smaller contributor to the active-room
+  confusion above than first estimated (this hook already preferred the hook payload's own
+  `session_id` ahead of the env check), but a real, worthwhile correctness fix on its own.
+
+## [1.15.3-beta.34] - 2026-07-21
+
+### Fixed
+- **Stop hook (`check-card-fire.cjs`) force-fired a stale Decision-Gate card on unrelated
+  terse turns.** Fourth live occurrence of the over-enforcement class (dominant reason
+  `reached-registry-gate-no-card`, 30 of 41 records in a 24h diagnostic window). Two stacked
+  root causes: (1) `lib/core/card-fire-sidechannel.cjs`'s reach-mint record had no
+  session/turn scoping and a 10-minute TTL, so one real gate mint anywhere leaked into every
+  later turn, every session, for 10 minutes; (2) `lib/core/gate-relevance.cjs`'s
+  `gateTopicallyRelevant` defaulted to force-fire whenever the preceding user text carried
+  fewer than 2 subject tokens -- true for nearly every terse slash command, so short turns
+  were the LEAST protected against a stale gate. Fixed structurally: a turn-scoped freshness
+  window (`TURN_FRESH_MS`) replaces the unscoped union, and the relevance floor now checks
+  gate staleness (`opts.gateStale`) instead of defaulting to force on low signal. A model
+  that has already judged a reach-card gate stale and moved on in prose is no longer
+  overridden by the hook. Verified end-to-end against the live incident shape; full
+  card-fire/gate-relevance/connector-registry suites green.
+
 ## [1.15.3-beta.32] - 2026-07-20
 
 ### Added

package/README.md

@@ -10,7 +10,7 @@
   Powered by PWS (Problems Worth Solving), an innovation methodology built and tested through 20 years of teaching by Prof. Lawrence Aronhime.
   Engineered by Jonathan Sagir.
 
-  [![Version](https://img.shields.io/badge/version-1.15.3--beta.26-1E3A6E)](CHANGELOG.md)
+  [![Version](https://img.shields.io/badge/version-1.15.3--beta.34-1E3A6E)](CHANGELOG.md)
   [![License](https://img.shields.io/badge/license-BSL_1.1-C8A43C)](LICENSE)
   [![Works on](https://img.shields.io/badge/CLI_+_Desktop_+_Cowork-2D6B4A)](#three-surfaces)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mindrian_os/cli",
-  "version": "1.15.3-beta.32",
+  "version": "1.15.3-beta.36",
   "description": "Install MindrianOS into Claude Code with one command -- `npx @mindrian_os/cli`. Ships the MindrianOS plugin (Larry + PWS methodology + Data Room) plus a setup/diagnostics CLI (install/doctor/update).",
   "scripts": {
     "mcp": "node bin/mindrian-mcp-server.cjs",