@thebassclef/lite 1.9.8 → 1.9.10

package/dist/lite/lib/state.sh

@@ -40,8 +40,9 @@ __state_check_binary_deps() {
   if [ "${__STATE_DEPS_CHECKED:-}" = "1" ]; then
     return 0
   fi
+  # Baseline deps — awk + jq required unconditionally
   local missing=""
-  for bin in awk python3 jq; do
+  for bin in awk jq; do
     command -v "$bin" >/dev/null 2>&1 || missing="$missing $bin"
   done
   if [ -n "$missing" ]; then
@@ -49,21 +50,63 @@ __state_check_binary_deps() {
 STATE ACCESSOR FAILURE
 Required binary missing from PATH:$missing
 
-These binaries are load-bearing for lib/state.sh accessors (Shape B
-YAML frontmatter extraction + JSON tooling).
+awk + jq are load-bearing for lib/state.sh accessors.
 
 Resolution:
-  macOS: brew install gawk python3 jq
-  Debian: sudo apt-get install gawk python3 jq
-
-Closes the bassclef#598 silent-failure class.
+  macOS: brew install gawk jq
+  Debian: sudo apt-get install gawk jq
 EOF
     return 4
   fi
+
+  # Per cli#308: YAML parser needs EITHER yq OR python3+PyYAML.
+  # Stock macOS has python3 but not PyYAML. Pre-cli#308, that mismatch
+  # caused silent failures where __state_check_binary_deps passed but
+  # the actual yaml parse failed with ModuleNotFoundError. Now we check
+  # that at least one working parser exists.
+  __state_check_yaml_parser || return 6
   export __STATE_DEPS_CHECKED=1
   return 0
 }
 
+# YAML parser check (per cli#308). Returns 0 if yq available OR
+# python3+yaml-module importable. Returns 6 if neither.
+__state_check_yaml_parser() {
+  # Cache the result per shell process.
+  if [ "${__STATE_YAML_PARSER:-}" = "yq" ] || [ "${__STATE_YAML_PARSER:-}" = "python3" ]; then
+    return 0
+  fi
+  # Prefer yq (faster + simpler contract).
+  if command -v yq >/dev/null 2>&1; then
+    export __STATE_YAML_PARSER=yq
+    return 0
+  fi
+  # Fall back to python3+PyYAML.
+  if command -v python3 >/dev/null 2>&1 && python3 -c "import yaml" >/dev/null 2>&1; then
+    export __STATE_YAML_PARSER=python3
+    return 0
+  fi
+  cat >&2 <<EOF
+STATE ACCESSOR FAILURE — no YAML parser available (per cli#308)
+
+lib/state.sh needs ONE of:
+  - yq (preferred — faster, no Python module needed)
+  - python3 + PyYAML module
+
+Both are missing on this machine.
+
+Resolution:
+  macOS (preferred): brew install yq
+  macOS (alt):       python3 -m pip install pyyaml
+  Debian: sudo apt-get install yq  OR  python3 -m pip install pyyaml
+
+Per cli#308 — this check closes the silent-failure class where
+python3 existed but PyYAML did not, and callers reported "goal not
+found" (wrong diagnosis).
+EOF
+  return 6
+}
+
 # yq2json — extract YAML frontmatter from markdown file, emit JSON.
 # Used by Shape B (markdown + YAML frontmatter + body) entity accessors.
 #
@@ -86,7 +129,7 @@ EOF
 # on invalid input) + @luminary michael-feathers (characterization
 # tests RED-first via fixtures/2026-09-06-silent-empty/).
 __state_yq2json() {
-  __state_check_binary_deps || return 4
+  __state_check_binary_deps || return $?
   local file="$1"
   if [ ! -f "$file" ]; then
     return 1
@@ -127,7 +170,23 @@ __state_yq2json() {
 
   local out
   local ec
-  out=$(awk '/^---$/{c++; next} c==1' "$file" | python3 -c "
+  # Per cli#308 — prefer yq when available, fall back to python3+PyYAML.
+  # __state_check_binary_deps (called at top of this function via return 4
+  # path) already resolved __STATE_YAML_PARSER to one of the two.
+  if [ "${__STATE_YAML_PARSER:-}" = "yq" ]; then
+    out=$(awk '/^---$/{c++; next} c==1' "$file" | yq -o=json '.' 2>&1)
+    ec=$?
+    if [ "$ec" -ne 0 ]; then
+      printf 'yaml parse failed (yq): %s\n' "$out" >&2
+      return 3
+    fi
+    # yq returns `null` for empty input; coerce to `{}` for consistency
+    # with python3 path.
+    if [ "$out" = "null" ]; then
+      out="{}"
+    fi
+  else
+    out=$(awk '/^---$/{c++; next} c==1' "$file" | python3 -c "
 import sys, yaml, json
 try:
     data = yaml.safe_load(sys.stdin) or {}
@@ -136,7 +195,8 @@ except Exception as e:
     print(f'yaml parse failed: {e}', file=sys.stderr)
     sys.exit(3)
 ")
-  ec=$?
+    ec=$?
+  fi
   # Instrument real-parse count for #1519 tests + observability.
   __STATE_YQ2JSON_PARSE_COUNT=$(( ${__STATE_YQ2JSON_PARSE_COUNT:-0} + 1 ))
   if [ "$ec" -ne 0 ]; then
@@ -185,18 +245,20 @@ __state_atomic_write() {
 # output) + @luminary michael-nygard (silent-fail wrap; write does not
 # crash caller).
 __state_yaml_write() {
-  __state_check_binary_deps || return 4
-  local path="$1"
+  __state_check_binary_deps || return $?
+  # Finding #6 (#2036): `local path` is a zsh-magic variable name — ties to
+  # $PATH when sourced from zsh. Renamed to `local p` throughout this file.
+  local p="$1"
   local field="$2"
   local value="$3"
-  if [ -z "$path" ] || [ -z "$field" ]; then
+  if [ -z "$p" ] || [ -z "$field" ]; then
     echo "__state_yaml_write: requires <path> <field> <value>" >&2
     return 2
   fi
   local dir
-  dir="$(dirname "$path")"
+  dir="$(dirname "$p")"
   [ -d "$dir" ] || mkdir -p "$dir" || return 4
-  local tmp="${path}.tmp.$$"
+  local tmp="${p}.tmp.$$"
   BASSCLEF_YAML_FIELD="$field" \
   BASSCLEF_YAML_VALUE="$value" \
   BASSCLEF_YAML_TMP="$tmp" \
@@ -213,7 +275,7 @@ except Exception as e:
     print(f"__state_yaml_write: safe_dump failed: {e}", file=sys.stderr)
     sys.exit(3)
 ' 2>&1 || { rm -f "$tmp"; return 3; }
-  mv "$tmp" "$path" || { rm -f "$tmp"; return 4; }
+  mv "$tmp" "$p" || { rm -f "$tmp"; return 4; }
 }
 
 # === Whereami (Shape A — JSON authoritative + markdown rendered) ===
@@ -239,21 +301,22 @@ state_whereami_get() {
 state_whereami_set() {
   local field="$1"
   local value="$2"
-  local path="docs/whereami.json"
+  local p="docs/whereami.json"
   if [ -z "$field" ] || [ -z "$value" ]; then
     echo "state_whereami_set: requires <field> <value>" >&2
     return 2
   fi
-  if [ ! -f "$path" ]; then
+  if [ ! -f "$p" ]; then
     echo "state_whereami_set: docs/whereami.json does not exist" >&2
     return 4
   fi
   local updated
-  # Use jq's setpath for nested field paths (e.g., 'phase.value')
+  # Use jq's setpath for nested field paths (e.g., 'phase.value').
+  # The jq `--arg path` names a jq variable (not shell) — safe to keep.
   updated="$(jq --arg path "$field" --arg val "$value" '
     setpath($path | split("."); $val)
-  ' "$path")" || return 3
-  __state_atomic_write "$path" "$updated"
+  ' "$p")" || return 3
+  __state_atomic_write "$p" "$updated"
 }
 
 # === IterationBet (Shape B — markdown + YAML frontmatter + body) ===
@@ -264,11 +327,11 @@ state_iteration_bet_get() {
     echo "state_iteration_bet_get: requires <slug>" >&2
     return 2
   fi
-  local path="docs/iteration-bets/${slug}.md"
-  if [ ! -f "$path" ]; then
+  local p="docs/iteration-bets/${slug}.md"
+  if [ ! -f "$p" ]; then
     return 1
   fi
-  __state_yq2json "$path"
+  __state_yq2json "$p"
 }
 
 # Special-purpose: returns the single active iteration bet (status=active),
@@ -333,25 +396,25 @@ state_roadmap_get() {
     echo "state_roadmap_get: requires <slug>" >&2
     return 2
   fi
-  local path="docs/roadmaps/${slug}.md"
-  if [ ! -f "$path" ]; then
+  local p="docs/roadmaps/${slug}.md"
+  if [ ! -f "$p" ]; then
     return 1
   fi
-  __state_yq2json "$path"
+  __state_yq2json "$p"
 }
 
 # Internal: rewrite a roadmap's frontmatter from JSON, preserving the body.
 __state_roadmap_write_frontmatter() {
   local slug="$1"
   local frontmatter_json="$2"
-  local path="docs/roadmaps/${slug}.md"
-  if [ ! -f "$path" ]; then
-    echo "__state_roadmap_write_frontmatter: roadmap $path not found" >&2
+  local p="docs/roadmaps/${slug}.md"
+  if [ ! -f "$p" ]; then
+    echo "__state_roadmap_write_frontmatter: roadmap $p not found" >&2
     return 1
   fi
   python3 -c "
 import sys, yaml, json
-path = '$path'
+path = '$p'
 fm = json.loads('''$frontmatter_json''')
 with open(path, 'r') as f:
     content = f.read()
@@ -726,15 +789,15 @@ state_chronicle_gate_evidence() {
     return 2
   fi
   # Try bassclef (chronicle/) and consumer-repo (docs/chronicle/) paths
-  local path=""
+  local p=""
   if [ -f "chronicle/${id}.md" ]; then
-    path="chronicle/${id}.md"
+    p="chronicle/${id}.md"
   elif [ -f "docs/chronicle/${id}.md" ]; then
-    path="docs/chronicle/${id}.md"
+    p="docs/chronicle/${id}.md"
   else
     return 1
   fi
-  __state_yq2json "$path" | jq -c '.gates_fired // []'
+  __state_yq2json "$p" | jq -c '.gates_fired // []'
 }
 
 # List chronicle IDs (filename without .md extension), optionally limited
@@ -1081,16 +1144,16 @@ __state_platform_resolve_path() {
 
 state_platform_get() {
   local key="${1:-}"
-  local path
-  path="$(__state_platform_resolve_path)"
-  if [ ! -f "$path" ]; then
+  local p
+  p="$(__state_platform_resolve_path)"
+  if [ ! -f "$p" ]; then
     return 1
   fi
   local json
   json="$(python3 -c "
 import sys, yaml, json
 try:
-    with open('$path') as f:
+    with open('$p') as f:
         data = yaml.safe_load(f) or {}
     print(json.dumps(data, default=str))
 except Exception as e:

package/dist/lite/lib/tier-check.sh

@@ -131,35 +131,35 @@ PYEOF
 # Mirrors detection shape from .claude/hooks/tier-tag-required-at-write.sh so
 # the reader half and the writer half stay consistent.
 resolve_file_tier() {
-  local path="$1"
-  if [ ! -f "$path" ]; then
+  local p="$1"
+  if [ ! -f "$p" ]; then
     return 0
   fi
 
   local tier=""
-  case "$path" in
+  case "$p" in
     *.md)
       # Frontmatter between --- markers, first 30 lines
       tier=$(awk '
         /^---/ { in_fm = !in_fm; if (!in_fm) exit; next }
         in_fm && /^tier:[[:space:]]/ { sub(/^tier:[[:space:]]*/, ""); sub(/[[:space:]]*$/, ""); print; exit }
         NR > 30 { exit }
-      ' "$path" 2>/dev/null)
+      ' "$p" 2>/dev/null)
       ;;
     *.sh|*.py)
-      tier=$(head -10 "$path" 2>/dev/null | grep -E '^#[[:space:]]*tier:[[:space:]]' | head -1 | sed -E 's/^#[[:space:]]*tier:[[:space:]]*//; s/[[:space:]]*$//')
+      tier=$(head -10 "$p" 2>/dev/null | grep -E '^#[[:space:]]*tier:[[:space:]]' | head -1 | sed -E 's/^#[[:space:]]*tier:[[:space:]]*//; s/[[:space:]]*$//')
       ;;
     *.yml|*.yaml)
-      tier=$(head -30 "$path" 2>/dev/null | grep -E '^#[[:space:]]*tier:[[:space:]]|^tier:[[:space:]]' | head -1 | sed -E 's/^#?[[:space:]]*tier:[[:space:]]*//; s/[[:space:]]*$//')
+      tier=$(head -30 "$p" 2>/dev/null | grep -E '^#[[:space:]]*tier:[[:space:]]|^tier:[[:space:]]' | head -1 | sed -E 's/^#?[[:space:]]*tier:[[:space:]]*//; s/[[:space:]]*$//')
       ;;
     *.json|*.jsonc)
-      tier=$(head -30 "$path" 2>/dev/null | grep -oE '"(_?tier)"[[:space:]]*:[[:space:]]*"[a-z]+"' | head -1 | sed -E 's/.*:[[:space:]]*"([a-z]+)"/\1/')
+      tier=$(head -30 "$p" 2>/dev/null | grep -oE '"(_?tier)"[[:space:]]*:[[:space:]]*"[a-z]+"' | head -1 | sed -E 's/.*:[[:space:]]*"([a-z]+)"/\1/')
       if [ -z "$tier" ]; then
-        tier=$(head -30 "$path" 2>/dev/null | grep -oE '//[[:space:]]*tier:[[:space:]]*[a-z]+' | head -1 | sed -E 's/.*tier:[[:space:]]*//')
+        tier=$(head -30 "$p" 2>/dev/null | grep -oE '//[[:space:]]*tier:[[:space:]]*[a-z]+' | head -1 | sed -E 's/.*tier:[[:space:]]*//')
       fi
       ;;
     *.txt)
-      tier=$(head -1 "$path" 2>/dev/null | grep -E '^#[[:space:]]*tier:[[:space:]]' | sed -E 's/^#[[:space:]]*tier:[[:space:]]*//; s/[[:space:]]*$//')
+      tier=$(head -1 "$p" 2>/dev/null | grep -E '^#[[:space:]]*tier:[[:space:]]' | sed -E 's/^#[[:space:]]*tier:[[:space:]]*//; s/[[:space:]]*$//')
       ;;
   esac
 

package/dist/lite/lib/tier-dependency-audit.sh

@@ -364,15 +364,15 @@ walk_graph_bfs() {
   while [ -s "$queue_file" ] && [ "$iter" -lt "$max_iter" ]; do
     iter=$((iter + 1))
     local next_file; next_file="$(mktemp)"
-    while IFS= read -r path; do
-      [ -z "$path" ] && continue
+    while IFS= read -r p; do
+      [ -z "$p" ] && continue
       # Skip if visited
-      if grep -Fxq "$path" "$visited_file" 2>/dev/null; then
+      if grep -Fxq "$p" "$visited_file" 2>/dev/null; then
         continue
       fi
-      echo "$path" >> "$visited_file"
+      echo "$p" >> "$visited_file"
       # Extract references from this file
-      "$extractor" "$path" 2>/dev/null | while IFS= read -r ref; do
+      "$extractor" "$p" 2>/dev/null | while IFS= read -r ref; do
         [ -n "$ref" ] && echo "$ref" >> "$next_file"
       done
     done < "$queue_file"
@@ -504,17 +504,17 @@ classify_files() {
   #   tag == target tier   → bucket 1 (ships correctly in this tier)
   #   no tag at all        → bucket 2a (safe mechanical tag)
   #   tag == other tier    → bucket 2b (chain-snap risk; per-file cure)
-  comm -12 "$intended_sorted" "$actual_sorted" | while IFS= read -r path; do
+  comm -12 "$intended_sorted" "$actual_sorted" | while IFS= read -r p; do
     # Look up tag for path in tags file. Returns "" for untagged (no tab)
     # or missing entry; returns tier value when tagged.
     local file_tag
-    file_tag="$(awk -F'\t' -v p="$path" '$1 == p { print ($2 ? $2 : ""); exit }' "$tags")"
+    file_tag="$(awk -F'\t' -v p="$p" '$1 == p { print ($2 ? $2 : ""); exit }' "$tags")"
     if [ "$file_tag" = "$tier" ]; then
-      echo "$path" >> "$bucket_1"
+      echo "$p" >> "$bucket_1"
     elif [ -z "$file_tag" ]; then
-      echo "$path" >> "$bucket_2a"
+      echo "$p" >> "$bucket_2a"
     else
-      echo "$path" >> "$bucket_2b"
+      echo "$p" >> "$bucket_2b"
     fi
   done
 
@@ -557,13 +557,13 @@ classify_files_combined() {
 
   # Bucket 1 + Bucket 2 — split intersection by tag presence.
   # In combined mode, ANY non-empty tag places the file in bucket 1.
-  comm -12 "$intended_sorted" "$actual_sorted" | while IFS= read -r path; do
+  comm -12 "$intended_sorted" "$actual_sorted" | while IFS= read -r p; do
     local file_tag
-    file_tag="$(awk -F'\t' -v p="$path" '$1 == p { print ($2 ? $2 : ""); exit }' "$tags")"
+    file_tag="$(awk -F'\t' -v p="$p" '$1 == p { print ($2 ? $2 : ""); exit }' "$tags")"
     if [ -n "$file_tag" ]; then
-      echo "$path" >> "$bucket_1"
+      echo "$p" >> "$bucket_1"
     else
-      echo "$path" >> "$bucket_2"
+      echo "$p" >> "$bucket_2"
     fi
   done
 
@@ -738,12 +738,12 @@ write_manifest_combined() {
 #   - SDLC trace logs
 # ---------------------------------------------------------------------------
 _is_substrate_relevant_path() {
-  local path="$1"
+  local p="$1"
   # Normalize leading ./ prefix so patterns match consistently.
   # Closure files mix "./foo" (from find) with "foo" (from git grep).
   # Per #1385 walker cure — extends G3 filter beyond initial pattern set.
-  path="${path#./}"
-  case "$path" in
+  p="${p#./}"
+  case "$p" in
     /*|../*|.git/*|*/.git/*) return 1 ;;
     # Runtime state — walker outputs + gate markers + session state + analysis.
     # None ship to adopters regardless of tier tag. Per #1385.
@@ -831,12 +831,12 @@ walk_graph_bfs_inbound() {
   while [ -s "$queue_file" ] && [ "$iter" -lt "$max_iter" ]; do
     iter=$((iter + 1))
     local next_file; next_file="$(mktemp)"
-    while IFS= read -r path; do
-      [ -z "$path" ] && continue
-      if grep -Fxq "$path" "$visited_file" 2>/dev/null; then continue; fi
-      echo "$path" >> "$visited_file"
-      # Look up callers of $path in the reverse index (path is column 1; caller is column 2)
-      awk -F'\t' -v p="$path" '$1 == p { print $2 }' "$rev_index" | while IFS= read -r caller; do
+    while IFS= read -r p; do
+      [ -z "$p" ] && continue
+      if grep -Fxq "$p" "$visited_file" 2>/dev/null; then continue; fi
+      echo "$p" >> "$visited_file"
+      # Look up callers of $p in the reverse index (path is column 1; caller is column 2)
+      awk -F'\t' -v p="$p" '$1 == p { print $2 }' "$rev_index" | while IFS= read -r caller; do
         [ -n "$caller" ] && echo "$caller" >> "$next_file"
       done
     done < "$queue_file"

package/dist/lite/presence/install/schedule-auto-save.taskscheduler.md

@@ -110,7 +110,7 @@ Unregister-ScheduledTask -TaskName "BassclefAutoSave" -Confirm:$false
 
 ## Alternatives
 
-- **WSL2 available?** Skip this doc; use `presence/install/schedule-auto-save.cron.sh` inside WSL. Cron there watches your Windows filesystem via `/mnt/c/Users/...`.
+- **WSL2 available?** Skip this doc; use `presence/install/schedule-auto-save.cron.sh` inside WSL. Cron there watches your Windows filesystem via the mounted `/mnt/c/` tree under your user profile.
 - **Prefer a .ps1 installer?** File a ticket. The current ship stays doc-only to avoid installer complexity for a population not yet observed. Path B (per-OS installers) upgrade is a follow-on.
 
 ## References

package/dist/lite/standards/lite-manifest-schema-changes.md

@@ -34,6 +34,89 @@ Every entry stays in this file for the life of the manifest. Never pruned. When
 
 ## Entries (newest first)
 
+### cli#305 — identifier-leak scrub self-exclude + commit author check (v1.15.3 → v1.15.4, 2026-10-04)
+
+- **Change type:** content-change (1 file: `.claude/hooks/pre-commit-identifier-leak-scrub.sh`). Check 2 now filters out hunks from the hook's own files, its test, the rule, and the pattern source. Check 3 added — scans `git var GIT_AUTHOR_IDENT` for the pattern set plus the `.local` suffix. BLOCK banner adds a resolution path pointing at the GitHub no-reply address.
+- **Fields:** 444 entries (unchanged). Content hash shifts on the `pre-commit-identifier-leak-scrub` hook slug.
+- **Version bump:** v1.15.3 → v1.15.4 (patch — content-only change on 1 slug; no entry count change). Rides on top of the Finding #7 bump (v1.15.3) when PRs land in order.
+- **Rationale:** Kunal cli#305 — first commit after `bassclef init` blocked on the check's own files; author identity leaked silently when `user.email` was unset on Mac. Class A identity leak sister to cli#313 + cli#320 shipped in v1.15.2. Per PR #2062 (planned).
+- **Downstream cure:** no action for adopters at exact-pin. Self-exclude paths are PATH-scoped, not pattern-scoped — leaks moved into non-self files still block. Author check is additive; adopters with clean emails see no change. Adopters whose git author ends in `.local` or carries a hostname pattern see the new BLOCK with a recipe pointing at `<username>@users.noreply.github.com`.
+- **Old shape retired:** nothing retired. Check 1 (message) + Check 2 (staged content, now filtered) + Check 3 (author) chain is additive.
+
+### #2036 Finding #7 — Playwright probe file-based fallback (v1.15.4 → v1.15.5, 2026-10-05)
+
+- **Change type:** content-change (1 file: `lib/capability-probe.sh`). `probe_mcp_playwright()` extended with four MCP config file fallback paths after the `CLAUDE_MCP_PLAYWRIGHT` env-var fast path. Fail-soft on missing `jq` + malformed JSON.
+- **Fields:** 444 entries (unchanged). Content hash shifts on the `capability-probe` lib slug.
+- **Version bump:** v1.15.4 → v1.15.5 (patch — content-change on existing lib slug per policy). Rebased on top of cli#305 which landed first.
+- **Rationale:** Kunal v1.6.4 adopter run installed Playwright MCP but did not set `CLAUDE_MCP_PLAYWRIGHT`; probe returned 1; `/riff` + `/build` skipped screenshots. Fallback now reads `.mcp.json`, project + user `.claude/settings.json`, and `~/.claude.json`. Per bassclef-upstream#2036 Finding #7 + PR #2060.
+- **Downstream cure:** nothing — byte-for-byte unchanged when `CLAUDE_MCP_PLAYWRIGHT` is set (fast path first). Adopters without the env var set gain file-based detection on the fly.
+- **Old shape retired:** immediately (new behavior is additive).
+
+### cli#313 + cli#320 — identity-leak sweep in luminary-pick + personas (v1.15.1 → v1.15.2, 2026-10-04)
+
+- **Change type:** content-change (2 files: `lib/luminary-pick.sh` + `.claude/skills/personas/SKILL.md`). luminary-pick basedir fallback moves from `$HOME/src/sunj-labs/bassclef` to `$CLAUDE_PROJECT_DIR` → `git rev-parse` → `pwd` chain, plus adds `.claude/luminaries/*.md` catalog fallback for lite tier. personas SKILL default slug changes from email-derived (`operator-[local-part]`) to plain `operator` (never from email).
+- **Fields:** 444 entries (unchanged). Content hash shifts on the `luminary-pick` lib slug + `personas` skill slug.
+- **Version bump:** v1.15.1 → v1.15.2 (patch; content-only on 2 slugs; no schema shape shift; no entry count change).
+- **Rationale:** bassclef-cli#313 (luminary-pick hardcoded eng path; adopters hit "catalog dir missing" every /launch Phase 3.5) + bassclef-cli#320 (operator slug derived from git email leaked GitHub account ID into committed docs). Kunal cold-adopter smoke caught both; shared class is "engineering assumption in cold paths" (per plan doc Slot 3).
+- **Downstream cure:** no action for adopters at exact-pin. Both changes are additive — lite tier adopters now get a working picker catalog; email-derived slugs never fire again. Operators wanting a display name beyond `operator` get an in-turn prompt instead.
+- **Old shape retired:** nothing retired. Both old shapes stay viable (BASSCLEF_DIR env var still honored first; manual slug entry still allowed via operator reply).
+
+### cli#307 — /build Phase 0 awk matches Step-N + WU-N (v1.15.0 → v1.15.1, 2026-10-04)
+
+- **Change type:** content-change (1 file: `.claude/skills/build/SKILL.md`). Phase 0 safety floor awk pattern + prose at L276 updated to recognize both `### Step-N` (new vocab per ADR-040 D1) and `### WU-N` (legacy).
+- **Fields:** 444 entries (unchanged). Content hash shifts on the `build` skill slug.
+- **Version bump:** v1.15.0 → v1.15.1 (patch; content-only change on 1 slug; no schema shape shift; no entry count change).
+- **Rationale:** bassclef-cli#307 — Kunal cold-adopter smoke caught the Phase 0 awk reading zero acceptance lines on Step-format specs. Partial-rename regression from ADR-040 D1 (Phase 1 grep got the rename, Phase 0 awk was missed).
+- **Downstream cure:** no action for adopters at exact-pin — the fix is additive (both heading forms match). Step-format specs now trigger the floor as designed. WU-format specs continue to work (characterization).
+- **Old shape retired:** nothing retired. The WU-only pattern leaves. The `(Step|WU)-` pattern stays indefinitely.
+
+### #2036 — install-written-paths manifest + lib + rule (v1.14.4 → v1.15.0, 2026-10-03)
+
+- **Change type:** content-add (3 new entries: `lib/install-written-paths.sh`, `.claude/rules/install-written-paths-mediation.md`, `.claude/hooks/session-reflection.d/83-install-written-paths-rebuild.sh`); content-change on `.claude/hooks/pre-commit-gate.sh` (filter block added for Kunal Finding #8 cure).
+- **Fields:** 441 entries → 444 entries (3 adds, 1 content_hash shift).
+- **Version bump:** v1.14.4 → v1.15.0 (content-add MINOR per discipline policy).
+- **Rationale:** bassclef-upstream#2036 Finding #8 structural cure. See `architecture/reviews/2026-10-03.md` + plan doc `docs/next-session-plan-2026-10-04-kunal-slots-5-6.md` Slot 5.
+- **Downstream cure:** no action for adopters at exact-pin — the new entries are additive and the lib's accessor API is new. Adopters pulling at `@thebassclef/lite@^1.15.0` get the cure automatically; the session-start fragment regenerates the install-written-paths manifest on first fresh-install session.
+- **Old shape retired:** nothing retired. All existing entries preserved.
+
+### #1777 — friction hook pattern adds stage|launch new skill vocabulary (v1.14.2 → v1.14.3, 2026-10-01)
+
+- **Change type:** content-change (1 file: `post-skill-friction-check` hook)
+- **Fields:** 439 entries → 439 entries (no add/remove). Content hash shifts on `post-skill-friction-check` slug (MAJOR_SKILLS_PATTERN regex extended with stage|launch per ADR-040 D1 rename grace window).
+- **Version bump:** v1.14.2 → v1.14.3 (patch — content-only change; no field add/remove; no shape shift). Rebased after #523's retirement-discipline cure landed as v1.14.2.
+- **Rationale:** PR #2028 closes #1777 (friction log never created because hook pattern matched old skill names only). Additive regex extension; grace-window compat preserved (preview|preview-build still match).
+- **Downstream cure:** none — adopters re-sync and the hook starts firing on current-vocabulary chain dispatches. Lazy-create of `docs/session-friction-log.md` happens on first real friction case.
+- **Old shape retired:** old pattern retired `2026-10-31` (grace window end for ADR-040 D1 vocabulary); current pattern keeps both until then.
+
+### #523 — retirement discipline + fixture allowlist pattern (v1.14.1 → v1.14.2, 2026-10-01)
+
+- **Change type:** content-change (2 files: `rule/lite-manifest-schema-change-discipline` + `standard/lite-manifest-schema-changes`)
+- **Fields:** 439 entries (unchanged). Content hashes shift on `.claude/rules/lite-manifest-schema-change-discipline.md` (gains a `## Retirements` section covering retirement-class discipline alongside additions) and `standards/lite-manifest-schema-changes.md` (gains the v1.14.0 entry for #1992 that this PR backfilled plus this v1.14.2 entry).
+- **Version bump:** v1.14.1 → v1.14.2 (patch; content-only change on 2 slugs; no schema shape shift; no entry count change).
+- **Rationale:** sunj-labs/bassclef-upstream#523 closed. 4 consecutive main-CI failures 2026-09-29 to 09-30 (SHAs `3c997584`, `02da6b8d`, `924d489f` on `substrate-check-phase`) traced to Test 16 — the Feathers v1.6.1 snapshot guard — seeing 2 entries drop after PR #1992's compat shim retirement. Prior addition-class discipline fired a mechanical ledger-pre-flight gate; retirement-class did not. This PR extends the existing rule with a `## Retirements` section (per Ousterhout contrarian: one rule, two sections) + ships a fixture allowlist pattern (`.claude/hooks/tests/fixtures/2026-09-16-lite-catalog-closure/retired-entries.txt`) + updates Test 16 to subtract allowlist rows before asserting zero drops + backfills the v1.14.0 ledger entry #1992 missed.
+- **Downstream cure:** none — adopters at `~1.14` get the rule content update at next sync. Any adopter authoring a retirement PR going forward follows the `## Retirements` section. Mechanical pre-commit hook (`pre-retire-discipline-check.sh`) deferred to a follow-on PR per Ousterhout (keep this PR scope-tight).
+- **Old shape retired:** none — additive discipline extension.
+- **Protects:** 4 upcoming retirement tickets (#266 S3 → npm move, #108 ADR-020 prototype deprecation, #1142 structural rename sweep, #1999 launch cadence rules) ship under the extended discipline.
+
+### #1992 — compounding-axis compat shim retirement (v1.13.2 → v1.14.0, 2026-09-28)
+
+- **Change type:** content-remove (2 entries dropped)
+- **Fields:** 441 entries → 439 entries. Removed entries: `hook/longrun-prep-compounding-axis-check` (`.claude/hooks/longrun-prep-compounding-axis-check.sh`) + `rule/compounding-axis-fresh-analysis` (`.claude/rules/compounding-axis-fresh-analysis.md`). Both were compat shim symlinks from the 2026-07-03 compounding-axis → compounding-sequence rename per PR #611 (bet 2026-07-03b WU-2).
+- **Version bump:** v1.13.2 → v1.14.0 (MINOR — content-remove per bump policy; adopters pinning major stay green, adopters pinning exact version must update).
+- **Rationale:** sunj-labs/bassclef-upstream#1989 — compat shim grace window (ADR-031 default) elapsed on 2026-10-03; harness scanned each symlink twice inflating the rule set at session start. Grep across `standards/bassclef-source-consumers.json` returned zero adopter pins on the old slug, so the shim was defensive dogma rather than adopter-driven. Both symlinks + the duplicate embedding JSON deleted at SHA `9884278f`. Rename targets (`compounding-sequence-fresh-analysis.md` + `longrun-prep-compounding-sequence-check.sh`) stay live under their post-rename names.
+- **Downstream cure:** none for adopters at `~1.13` or `~1.14`. Adopters pinning exact `manifest_version` (bassclef-web#256 + bassclef-cli#51) update pins at the next sync. Any adopter code reading `.entries[]` by legacy `compounding-axis` slug finds nothing — switch reads to `compounding-sequence` sister slugs.
+- **Old shape retired:** immediately. ADR-031 grace window on compat shim ran its full term (2026-07-03 → 2026-10-03); no further compat preservation owed.
+- **Retirement allowlist:** `.claude/hooks/tests/fixtures/2026-09-16-lite-catalog-closure/retired-entries.txt` carries both removed slugs so Test 16 (Feathers v1.6.1 snapshot guard) subtracts them before asserting zero drops. Backfilled by follow-on PR #<this PR> (sunj-labs/bassclef-upstream#523).
+
+### #1777 — friction hook pattern adds stage|launch new skill vocabulary (v1.14.0 → v1.14.1, 2026-10-01)
+
+- **Change type:** content-change (1 file: `post-skill-friction-check` hook)
+- **Fields:** 439 entries → 439 entries (no add/remove). Content hash shifts on `post-skill-friction-check` slug (MAJOR_SKILLS_PATTERN regex extended with stage|launch per ADR-040 D1 rename grace window).
+- **Version bump:** v1.14.0 → v1.14.1 (patch — content-only change; no field add/remove; no shape shift).
+- **Rationale:** PR #2028 closes #1777 (friction log never created because hook pattern matched old skill names only). Additive regex extension; grace-window compat preserved (preview|preview-build still match).
+- **Downstream cure:** none — adopters re-sync and the hook starts firing on current-vocabulary chain dispatches. Lazy-create of `docs/session-friction-log.md` happens on first real friction case.
+- **Old shape retired:** old pattern retired `2026-10-31` (grace window end for ADR-040 D1 vocabulary); current pattern keeps both until then.
+
 ### #1961 — persistent statusline for bassclef version + sync status (v1.12.2 → v1.13.0, 2026-09-27)
 
 - **Change type:** content-add (1 new entry: `statusline-version` lib) + content-change (2 files: `bassclef-sync` hook + `bassclef-orientation`)