oh-my-customcode 1.1.38 → 1.1.40

package/dist/cli/index.js

@@ -241,7 +241,7 @@ var init_package = __esm(() => {
     workspaces: [
       "packages/*"
     ],
-    version: "1.1.38",
+    version: "1.1.40",
     description: "Batteries-included agent harness for Claude Code",
     type: "module",
     bin: {

package/dist/index.js

@@ -2031,7 +2031,7 @@ var package_default = {
   workspaces: [
     "packages/*"
   ],
-  version: "1.1.38",
+  version: "1.1.40",
   description: "Batteries-included agent harness for Claude Code",
   type: "module",
   bin: {

package/package.json

@@ -3,7 +3,7 @@
   "workspaces": [
     "packages/*"
   ],
-  "version": "1.1.38",
+  "version": "1.1.40",
   "description": "Batteries-included agent harness for Claude Code",
   "type": "module",
   "bin": {

package/templates/.claude/hooks/hooks.json

@@ -261,12 +261,16 @@
             "type": "command",
             "command": "bash .claude/hooks/scripts/auto-continue-guard.sh"
           },
+          {
+            "type": "command",
+            "command": "bash .claude/hooks/scripts/r007-r008-drift-advisor.sh"
+          },
           {
             "type": "prompt",
             "prompt": "A background subagent just completed. If it FAILED, do NOT auto-continue \u2014 report the failure and wait for user input."
           }
         ],
-        "description": "Record agent outcomes + auto-continue workflow on subagent completion"
+        "description": "Record agent outcomes + auto-continue workflow + R007/R008 drift advisory on subagent completion (autonomous-loop re-entry, #1545)"
       }
     ],
     "CwdChanged": [

package/templates/.claude/hooks/scripts/r007-r008-drift-advisor.sh

@@ -1,15 +1,43 @@
 #!/usr/bin/env bash
-# r007-r008-drift-advisor.sh — UserPromptSubmit hook: PROACTIVE R007/R008 drift advisory (#1229)
+# r007-r008-drift-advisor.sh — PROACTIVE R007/R008 drift advisory (#1229, #1545, #1547)
+#
+# Wired to TWO trigger points:
+#   1. UserPromptSubmit — fires before Claude responds to a user-typed prompt (#1229).
+#   2. SubagentStop — fires when a background subagent (Agent tool) completes, covering
+#      autonomous-loop re-entry (e.g. /fsd) where the orchestrator resumes WITHOUT a
+#      UserPromptSubmit event. Prior to #1545, autonomous-loop re-entry had zero R007/R008
+#      advisory coverage since UserPromptSubmit never fires in that path.
 #
 # Inspects the LAST completed assistant turn in the session transcript for R007/R008
 # compliance BEFORE Claude responds. If the previous turn drifted (missing identification
-# header / tool prefix), emits a stderr advisory so the upcoming response self-corrects.
+# header / tool prefix), delivers an advisory so the upcoming response self-corrects.
 #
 # This is the PROACTIVE complement to the retroactive session-reflection.sh (Stop hook, #1190).
 # Detection patterns are reused from session-reflection.sh.
 #
-# Advisory-only: ALWAYS exits 0, ALWAYS passes stdin through to stdout, NEVER blocks.
+# Advisory-only: ALWAYS exits 0, NEVER blocks.
 # Performance: parses ONLY the last assistant turn (not the whole transcript).
+# Input-schema note: session_id/transcript_path are COMMON fields present on both
+# UserPromptSubmit and SubagentStop hook payloads, so the detection logic below is
+# event-agnostic and required no functional changes for the SubagentStop wiring.
+#
+# Delivery mechanism (#1547 fix):
+#   Prior to this fix, the advisory was written to stderr with exit 0. Per the official
+#   Claude Code hook spec, stderr on exit 0 is NEVER fed into the model's context for ANY
+#   hook event (it is only visible in transcript debug mode, i.e. to a human, not Claude) —
+#   so #1545's SubagentStop wiring never actually reached the model despite firing correctly.
+#   The confirmed non-blocking delivery path for BOTH UserPromptSubmit and SubagentStop is
+#   `hookSpecificOutput.additionalContext` in JSON stdout with exit 0:
+#     {"hookSpecificOutput": {"hookEventName": "<event>", "additionalContext": "<text>"}}
+#   This is NOT the same as `"decision": "block"` — that would force Stop/SubagentStop to
+#   block (refuse to stop), which is exactly the blocking behavior R021 (advisory-first
+#   enforcement) forbids for this hook. additionalContext alone (no `decision` field) is
+#   non-blocking: Claude is allowed to stop/continue normally and simply sees the extra
+#   context on its next turn. Exit code MUST stay 0 — exit 2 causes Claude Code to discard
+#   any JSON output and treat stderr as a blocking error instead (see Common JSON Fields /
+#   Exit Code Behavior in the official hook reference).
+#   The stderr line is kept for human-visible audit trail (harmless on exit 0) but is no
+#   longer the delivery mechanism.
 #
 # 환경변수 override (테스트/디버깅용):
 #   OMCUSTOM_R007_ADVISOR=off  — advisory 완전 비활성화 (pass-through)
@@ -17,34 +45,36 @@
 
 set -euo pipefail
 
-# ── UserPromptSubmit 프로토콜: stdin을 먼저 읽음 ──
+# ── stdin 읽기 ──
 input=$(cat)
 
 # ── Opt-out 체크 ──
 if [ "${OMCUSTOM_R007_ADVISOR:-}" = "off" ]; then
-  echo "$input"
   exit 0
 fi
 
 # ── jq 의존성 체크 ──
 if ! command -v jq >/dev/null 2>&1; then
-  echo "$input"
   exit 0
 fi
 
 # ── session_id 추출 ──
 session_id=$(echo "$input" | jq -r '.session_id // empty' 2>/dev/null)
 if [ -z "$session_id" ]; then
-  echo "$input"
   exit 0
 fi
 
+# ── hook_event_name 추출 (hookSpecificOutput.hookEventName에 되돌려줄 값) ──
+hook_event_name=$(echo "$input" | jq -r '.hook_event_name // empty' 2>/dev/null)
+if [ -z "$hook_event_name" ]; then
+  hook_event_name="UserPromptSubmit"
+fi
+
 # ── 경로 결정 (환경변수 override 지원) ──
 TRANSCRIPT_BASE="${OMCUSTOM_TRANSCRIPT_BASE:-${HOME}/.claude/projects/-Users-sangyi-workspace-projects-oh-my-customcode}"
 TRANSCRIPT_PATH="${TRANSCRIPT_BASE}/${session_id}.jsonl"
 
 if [ ! -f "$TRANSCRIPT_PATH" ]; then
-  echo "$input"
   exit 0
 fi
 
@@ -60,7 +90,6 @@ while IFS= read -r line; do
 done < <(tail -r "$TRANSCRIPT_PATH" 2>/dev/null || tac "$TRANSCRIPT_PATH" 2>/dev/null)
 
 if [ -z "$last_assistant" ]; then
-  echo "$input"
   exit 0
 fi
 
@@ -106,12 +135,21 @@ while [ "$i" -lt "$content_length" ]; do
   i=$((i+1))
 done
 
-# ── advisory 출력 (위반 시에만) ──
+# ── advisory 전달 (위반 시에만) ──
 if [ "$r007_violations" -gt 0 ] || [ "$r008_violations" -gt 0 ]; then
-  printf '[R007/R008 Advisory] 직전 응답에서 식별 누락 감지 (R007 헤더=%d, R008 접두사=%d). 이번 응답은 ┌─ Agent: 헤더로 시작하고, 모든 도구 호출에 [agent][model] → Tool: 접두사를 포함하십시오.\n' \
-    "$r007_violations" "$r008_violations" >&2
+  advisory_text=$(printf '[R007/R008 Advisory] 직전 응답에서 식별 누락 감지 (R007 헤더=%d, R008 접두사=%d). 이번 응답은 ┌─ Agent: 헤더로 시작하고, 모든 도구 호출에 [agent][model] → Tool: 접두사를 포함하십시오.' \
+    "$r007_violations" "$r008_violations")
+
+  # 사람이 보는 감사 추적용 (exit 0에서는 모델에 전달되지 않음 — #1547 참고)
+  printf '%s\n' "$advisory_text" >&2
+
+  # #1547 fix: hookSpecificOutput.additionalContext로 모델 컨텍스트에 실제 전달.
+  # decision 필드는 절대 포함하지 않는다 — "block"을 쓰면 Stop/SubagentStop 정지를
+  # 강제로 막아버려 advisory-only 원칙(R021)을 위반하게 된다. exit code는 반드시 0.
+  jq -cn --arg event "$hook_event_name" --arg ctx "$advisory_text" \
+    '{hookSpecificOutput: {hookEventName: $event, additionalContext: $ctx}}'
 fi
 
-# ── 항상 stdin pass-through 후 exit 0 (advisory는 절대 차단 금지) ──
-echo "$input"
+# ── 위반이 없으면 아무것도 출력하지 않는다 (오탐 방지) ──
+# ── 항상 exit 0 (advisory는 절대 차단 금지) ──
 exit 0

package/templates/.claude/rules/MUST-enforcement-policy.md

@@ -14,7 +14,7 @@ oh-my-customcode uses an **advisory-first enforcement model**. Most rules are en
 | Soft Block | Stop hook prompt | R011 session-end saves | Auto-performs then approves |
 | Conversation Block | PostToolUse hook + `continueOnBlock` (CC v2.1.139+), exit 2 | stuck-detector, context-budget-advisor, cost-cap-advisor | Feeds rejection reason into conversation; Claude continues with awareness |
 | Advisory | PostToolUse hooks | R007, R008, R009, R010, R018 | Warns via stderr, never blocks |
-| Advisory (proactive) | UserPromptSubmit hook | R007, R008 (`r007-r008-drift-advisor.sh`, #1229) | Reads last assistant turn; emits stderr advisory before next response if header/prefix absent. Complements retroactive Stop-hook (`session-reflection.sh`, #1190). |
+| Advisory (proactive) | UserPromptSubmit + SubagentStop hooks | R007, R008 (`r007-r008-drift-advisor.sh`, #1229 UserPromptSubmit; #1545 added SubagentStop) | Reads last assistant turn; emits stderr advisory if header/prefix absent. SubagentStop wiring (#1545) closes a structural gap: UserPromptSubmit fires only on user input, so long-lived autonomous loops (e.g. `/fsd`) that re-enter via task notifications (no user input) never reached the advisor — measured 2026-07-30: 6 responses / 12 tool calls with missing R007/R008 and zero advisory fires. Complements retroactive Stop-hook (`session-reflection.sh`, #1190). **Delivery gap resolved (#1547, v1.1.40)**: stderr on exit 0 is never injected into model context by any hook event, so #1545's wiring fired without reaching the model. The advisory is now delivered via `hookSpecificOutput.additionalContext` (JSON stdout, exit 0) — the confirmed non-blocking context-injection path for both events; stderr is retained only as a human-visible audit trail. No top-level `decision`/`continue`/`stopReason` field is emitted, so the hook stays advisory (never blocks a Stop/SubagentStop). |
 | Prompt-based | CLAUDE.md + rules/ + PostCompact | All MUST rules | Behavioral guidance in context |
 
 <!--
@@ -34,7 +34,7 @@ oh-my-customcode uses an **advisory-first enforcement model**. Most rules are en
 3. **Composability**: External skills and internal rules can coexist without deadlocks
 4. **PostCompact reinforcement**: R007/R008/R009/R010/R018 are re-injected after context compaction
 
-## Hard Enforcement Candidates — R010 git-delegation-guard (conditional), R007/R008 UserPromptSubmit advisory **implemented** (#1229, proactive) + retroactive Stop-hook (#1190); hard-block variant still candidate if advisory insufficient (#1096). Promoted: rule-deletion-guard.sh (2026-04-08). See details via Read tool.
+## Hard Enforcement Candidates — R010 git-delegation-guard (conditional), R007/R008 advisory **implemented** (#1229 UserPromptSubmit, proactive) + **#1545 SubagentStop** (closes autonomous-loop gap) + retroactive Stop-hook (#1190); model-context delivery fixed via `hookSpecificOutput.additionalContext` (#1547, v1.1.40); hard-block variant still candidate if advisory insufficient (#1096). Promoted: rule-deletion-guard.sh (2026-04-08). See details via Read tool.
 
 <!-- DETAIL: Hard Enforcement Candidates (Future)
 If advisory enforcement proves insufficient for specific rules, these are candidates for promotion to hard-block:
@@ -42,7 +42,7 @@ If advisory enforcement proves insufficient for specific rules, these are candid
 | Rule | Candidate Hook | Status | Condition for Promotion |
 |------|---------------|--------|------------------------|
 | R010 | git-delegation-guard.sh | Candidate | If orchestrator-direct-write violations exceed 3/session |
-| R007/R008 | `r007-r008-drift-advisor.sh` (UserPromptSubmit, #1229) | **Advisory implemented** — proactive pre-response check; retroactive: `session-reflection.sh` (Stop, #1190). Two-layer drift detection: proactive (#1229) + retroactive (#1190). | Promote to hard-block if advisory proves insufficient (#1096) |
+| R007/R008 | `r007-r008-drift-advisor.sh` (UserPromptSubmit #1229 + SubagentStop #1545) | **Advisory implemented** — proactive pre-response check now wired to both UserPromptSubmit and SubagentStop; the SubagentStop leg (#1545) closes the no-user-input autonomous-loop gap (`/fsd` etc.). Retroactive: `session-reflection.sh` (Stop, #1190). Two-layer drift detection: proactive (#1229/#1545) + retroactive (#1190). **Delivery mechanism fixed (#1547, v1.1.40)** — stderr on exit 0 reaches only a human (transcript debug mode), never the model, so wiring alone did not prove advisory reach; the advisory now travels via `hookSpecificOutput.additionalContext` on JSON stdout with exit 0, and emits no top-level `decision`/`continue`/`stopReason` so it remains non-blocking. | Promote to hard-block if advisory proves insufficient (#1096) |
 
 Promotion requires: (1) measured violation rate data, (2) user approval, (3) rollback plan.
 

package/templates/.claude/skills/pipeline/workflows/auto-dev.yaml

@@ -210,7 +210,11 @@ steps:
          - Detect file types in scope and route to matching agent
          - Use specialized agents (lang-*, be-*, fe-*, infra-*) over general-purpose
       4. TDD via superpowers:test-driven-development when tests apply
-      5. Commit via mgr-gitnerd with `Fixes #<N>` trailer in body
+      5. Commit via mgr-gitnerd with `Refs #<N>` trailer in body — NEVER `Fixes`/`Closes`/`Resolves` (#1542).
+         ⚠ implement-stage commits land directly on develop (no PR gate here). A close-keyword trailer on a
+         develop-bound commit auto-closes the issue on push — BEFORE release/tag/publish (observed v1.1.38,
+         07:49:26Z). Close keywords belong ONLY in the release-stage PR body (see release step 3.b) — auto-tag.yml
+         greps the PR body, not commit messages, to decide which issues to close.
       6. On success: remove in-progress, add verify-ready
       7. On failure: remove in-progress, add needs-review, comment error summary
 
@@ -299,21 +303,38 @@ steps:
          Reference: issue #1141 (v0.135.0 follow-up), mgr-gitnerd MEMORY.md.
 
       1. Version bump (mandatory):
-         Orchestrator delegates to mgr-updater (R010). mgr-updater executes the following atomic edits:
-         Determine NEW version per semver rules below.
+         Orchestrator delegates to mgr-updater (R010) for the file edits below; mgr-gitnerd (R010) for branch/commit/push.
+         Determine NEW version per semver rules below FIRST — before touching any file.
+
+         ⚠ Branch-before-bump (#1542, observed v1.1.38): for npm project with auto-tag.yml (this repo), the
+         version-bump commit MUST be created ON release/v{NEW}, and MUST NOT be pushed to develop directly.
+         Pushing the bump commit to develop before branching leaves develop and release/v{NEW} pointing at the
+         SAME commit → PR diff=0 → `gh pr create` fails with "GraphQL: No commits between develop and
+         release/v{NEW}". Evidence: PR #1538 (v1.1.37) and PR #1534 (v1.1.36) each contain exactly ONE commit
+         (the bump commit) — proof the bump belongs on the release branch, never on develop directly.
+
          npm project (package.json exists):
-           a. package.json: jq '.version = "<NEW>"' package.json > package.json.tmp && mv package.json.tmp package.json
+           a. mgr-gitnerd: git checkout develop && git pull origin develop
+              (R017 Pre-Branch Freshness Gate — ensures local develop holds every merged feature commit before branching)
+           b. mgr-gitnerd creates release/v{NEW} branch from develop and checks it out — BEFORE any edit in c–i below.
+              (This is the step that used to run AFTER the bump in step 3.a of the old ordering — moving it here
+              is the #1542 fix. Do NOT perform steps c–i on develop.)
+           c. package.json: jq '.version = "<NEW>"' package.json > package.json.tmp && mv package.json.tmp package.json   [on release/v{NEW}]
            # ⚠ jq '.version=...' PRESERVES the manifest structure {version, lastUpdated, omcustomMinClaudeCode, components[]}.
            #   Edit ONLY the .version field — do NOT overwrite templates/manifest.json wholesale (e.g. a source-hash path→hash map).
            #   Recover a corrupted manifest: git show HEAD:templates/manifest.json | jq '.version="<NEW>"' > templates/manifest.json (#1423/#1154).
-           b. templates/manifest.json: jq '.version = "<NEW>"' templates/manifest.json > templates/manifest.json.tmp && mv templates/manifest.json.tmp templates/manifest.json
-           c. bun run build — run standalone (NO pipe), read exit code directly ($? after a pipe is the last command's, R005/#1492).
-              This regenerates .omcustom.lock.json (generatorVersion/templateVersion) to <NEW> via scripts/sync-source-lockfile.ts.
-           d. git status --short — enumerate ALL tracked drift (`^ M`) the build produced; stage EVERY one (esp. .omcustom.lock.json) before commit.
-              (#1531 — .omcustom.lock.json missed staging across 4 consecutive releases after v1.1.29; root cause was no build step between version bump and commit.)
-           e. mgr-gitnerd commit: "chore(release): bump to v<NEW>" — MUST include the drift from step d
-           f. mgr-gitnerd push develop
-           g. mandatory verification (with existence guard for partial-update safety):
+           d. templates/manifest.json: jq '.version = "<NEW>"' templates/manifest.json > templates/manifest.json.tmp && mv templates/manifest.json.tmp templates/manifest.json   [on release/v{NEW}]
+           e. bun run build — run standalone (NO pipe), read exit code directly ($? after a pipe is the last command's, R005/#1492).
+              This regenerates .omcustom.lock.json (generatorVersion/templateVersion) to <NEW> via scripts/sync-source-lockfile.ts.   [on release/v{NEW}]
+           f. git status --short — enumerate ALL tracked drift (`^ M`) the build produced; stage EVERY one (esp. .omcustom.lock.json) before commit.
+              (#1531 — .omcustom.lock.json missed staging across 4 consecutive releases after v1.1.29; root cause was no build step between version bump and commit.)   [on release/v{NEW}]
+           g. mgr-gitnerd commit: "chore(release): bump to v<NEW>" — MUST include the drift from step f.
+              ⚠ do NOT add Closes/Fixes/Resolves keywords to this commit message (#1542) — this commit merges into
+              develop later via the release PR; a close keyword here bypasses the PR-body mechanism auto-tag.yml
+              relies on (see step 3.b below). Use `Refs #N` if a cross-reference is needed.
+           h. mgr-gitnerd push release/v{NEW} to origin — NEVER push this commit to develop directly. Pushing to
+              develop here reproduces the diff=0 PR failure this reordering fixes (#1542).
+           i. mandatory verification (with existence guard for partial-update safety), run on release/v{NEW}:
               [ -f scripts/verify-version-sync.sh ] && bash scripts/verify-version-sync.sh || echo "::warning::verify-version-sync.sh not found, version sync verification skipped"
               (verify-version-sync.sh 가 exit 1 시 release 단계 halt)
 
@@ -328,9 +349,10 @@ steps:
       2. Release notes via omcustom-release-notes skill
       3. Adapt release mechanism to project (determines how steps 3-5 execute):
          - npm project with auto-tag.yml (this repo — release/v* PR pattern):
-           a. mgr-gitnerd creates release/v{NEW} branch from develop with the version-bump commit
+           a. release/v{NEW} branch + version-bump commit were already created in step 1.b–1.h above — do NOT
+              re-create the branch or re-run the bump here; this step only opens the PR against the existing branch.
            b. mgr-gitnerd creates PR: gh pr create --base develop --head release/v{NEW} --title "chore(release): bump to v{NEW}" --body "<MUST include 'Closes #N' for EVERY issue this release resolves>"
-              ⚠ auto-tag.yml closes issues by grep'ing Closes/Fixes/Resolves keywords in the PR BODY — NOT by milestone membership. If the keywords are missing, no issues close and the workflow still reports success (#1531).
+              ⚠ auto-tag.yml closes issues by grep'ing Closes/Fixes/Resolves keywords in the PR BODY — NOT by milestone membership NOR by commit message trailers. If the keywords are missing, no issues close and the workflow still reports success (#1531). Commit-message close keywords are explicitly forbidden during `implement` and step 1.g above (#1542) — the PR body is the ONLY place a close keyword should appear.
               Before creating the PR (whether via inline --body or --body-file), confirm the body text actually contains a Closes line per issue.
            c. mgr-gitnerd merges PR (admin merge required due to branch protection)
            d. DO NOT manually git tag or gh release create.

package/templates/manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.1.38",
+  "version": "1.1.40",
   "lastUpdated": "2026-07-14T00:00:00.000Z",
   "omcustomMinClaudeCode": "2.1.121",
   "omcustomMinClaudeCodeReason": "Sensitive-path direct Write/Edit on .claude/** under bypassPermissions (R010 deprecation, #1101)",

package/templates/workflows/auto-dev.yaml

@@ -210,7 +210,11 @@ steps:
          - Detect file types in scope and route to matching agent
          - Use specialized agents (lang-*, be-*, fe-*, infra-*) over general-purpose
       4. TDD via superpowers:test-driven-development when tests apply
-      5. Commit via mgr-gitnerd with `Fixes #<N>` trailer in body
+      5. Commit via mgr-gitnerd with `Refs #<N>` trailer in body — NEVER `Fixes`/`Closes`/`Resolves` (#1542).
+         ⚠ implement-stage commits land directly on develop (no PR gate here). A close-keyword trailer on a
+         develop-bound commit auto-closes the issue on push — BEFORE release/tag/publish (observed v1.1.38,
+         07:49:26Z). Close keywords belong ONLY in the release-stage PR body (see release step 3.b) — auto-tag.yml
+         greps the PR body, not commit messages, to decide which issues to close.
       6. On success: remove in-progress, add verify-ready
       7. On failure: remove in-progress, add needs-review, comment error summary
 
@@ -299,21 +303,38 @@ steps:
          Reference: issue #1141 (v0.135.0 follow-up), mgr-gitnerd MEMORY.md.
 
       1. Version bump (mandatory):
-         Orchestrator delegates to mgr-updater (R010). mgr-updater executes the following atomic edits:
-         Determine NEW version per semver rules below.
+         Orchestrator delegates to mgr-updater (R010) for the file edits below; mgr-gitnerd (R010) for branch/commit/push.
+         Determine NEW version per semver rules below FIRST — before touching any file.
+
+         ⚠ Branch-before-bump (#1542, observed v1.1.38): for npm project with auto-tag.yml (this repo), the
+         version-bump commit MUST be created ON release/v{NEW}, and MUST NOT be pushed to develop directly.
+         Pushing the bump commit to develop before branching leaves develop and release/v{NEW} pointing at the
+         SAME commit → PR diff=0 → `gh pr create` fails with "GraphQL: No commits between develop and
+         release/v{NEW}". Evidence: PR #1538 (v1.1.37) and PR #1534 (v1.1.36) each contain exactly ONE commit
+         (the bump commit) — proof the bump belongs on the release branch, never on develop directly.
+
          npm project (package.json exists):
-           a. package.json: jq '.version = "<NEW>"' package.json > package.json.tmp && mv package.json.tmp package.json
+           a. mgr-gitnerd: git checkout develop && git pull origin develop
+              (R017 Pre-Branch Freshness Gate — ensures local develop holds every merged feature commit before branching)
+           b. mgr-gitnerd creates release/v{NEW} branch from develop and checks it out — BEFORE any edit in c–i below.
+              (This is the step that used to run AFTER the bump in step 3.a of the old ordering — moving it here
+              is the #1542 fix. Do NOT perform steps c–i on develop.)
+           c. package.json: jq '.version = "<NEW>"' package.json > package.json.tmp && mv package.json.tmp package.json   [on release/v{NEW}]
            # ⚠ jq '.version=...' PRESERVES the manifest structure {version, lastUpdated, omcustomMinClaudeCode, components[]}.
            #   Edit ONLY the .version field — do NOT overwrite templates/manifest.json wholesale (e.g. a source-hash path→hash map).
            #   Recover a corrupted manifest: git show HEAD:templates/manifest.json | jq '.version="<NEW>"' > templates/manifest.json (#1423/#1154).
-           b. templates/manifest.json: jq '.version = "<NEW>"' templates/manifest.json > templates/manifest.json.tmp && mv templates/manifest.json.tmp templates/manifest.json
-           c. bun run build — run standalone (NO pipe), read exit code directly ($? after a pipe is the last command's, R005/#1492).
-              This regenerates .omcustom.lock.json (generatorVersion/templateVersion) to <NEW> via scripts/sync-source-lockfile.ts.
-           d. git status --short — enumerate ALL tracked drift (`^ M`) the build produced; stage EVERY one (esp. .omcustom.lock.json) before commit.
-              (#1531 — .omcustom.lock.json missed staging across 4 consecutive releases after v1.1.29; root cause was no build step between version bump and commit.)
-           e. mgr-gitnerd commit: "chore(release): bump to v<NEW>" — MUST include the drift from step d
-           f. mgr-gitnerd push develop
-           g. mandatory verification (with existence guard for partial-update safety):
+           d. templates/manifest.json: jq '.version = "<NEW>"' templates/manifest.json > templates/manifest.json.tmp && mv templates/manifest.json.tmp templates/manifest.json   [on release/v{NEW}]
+           e. bun run build — run standalone (NO pipe), read exit code directly ($? after a pipe is the last command's, R005/#1492).
+              This regenerates .omcustom.lock.json (generatorVersion/templateVersion) to <NEW> via scripts/sync-source-lockfile.ts.   [on release/v{NEW}]
+           f. git status --short — enumerate ALL tracked drift (`^ M`) the build produced; stage EVERY one (esp. .omcustom.lock.json) before commit.
+              (#1531 — .omcustom.lock.json missed staging across 4 consecutive releases after v1.1.29; root cause was no build step between version bump and commit.)   [on release/v{NEW}]
+           g. mgr-gitnerd commit: "chore(release): bump to v<NEW>" — MUST include the drift from step f.
+              ⚠ do NOT add Closes/Fixes/Resolves keywords to this commit message (#1542) — this commit merges into
+              develop later via the release PR; a close keyword here bypasses the PR-body mechanism auto-tag.yml
+              relies on (see step 3.b below). Use `Refs #N` if a cross-reference is needed.
+           h. mgr-gitnerd push release/v{NEW} to origin — NEVER push this commit to develop directly. Pushing to
+              develop here reproduces the diff=0 PR failure this reordering fixes (#1542).
+           i. mandatory verification (with existence guard for partial-update safety), run on release/v{NEW}:
               [ -f scripts/verify-version-sync.sh ] && bash scripts/verify-version-sync.sh || echo "::warning::verify-version-sync.sh not found, version sync verification skipped"
               (verify-version-sync.sh 가 exit 1 시 release 단계 halt)
 
@@ -328,9 +349,10 @@ steps:
       2. Release notes via omcustom-release-notes skill
       3. Adapt release mechanism to project (determines how steps 3-5 execute):
          - npm project with auto-tag.yml (this repo — release/v* PR pattern):
-           a. mgr-gitnerd creates release/v{NEW} branch from develop with the version-bump commit
+           a. release/v{NEW} branch + version-bump commit were already created in step 1.b–1.h above — do NOT
+              re-create the branch or re-run the bump here; this step only opens the PR against the existing branch.
            b. mgr-gitnerd creates PR: gh pr create --base develop --head release/v{NEW} --title "chore(release): bump to v{NEW}" --body "<MUST include 'Closes #N' for EVERY issue this release resolves>"
-              ⚠ auto-tag.yml closes issues by grep'ing Closes/Fixes/Resolves keywords in the PR BODY — NOT by milestone membership. If the keywords are missing, no issues close and the workflow still reports success (#1531).
+              ⚠ auto-tag.yml closes issues by grep'ing Closes/Fixes/Resolves keywords in the PR BODY — NOT by milestone membership NOR by commit message trailers. If the keywords are missing, no issues close and the workflow still reports success (#1531). Commit-message close keywords are explicitly forbidden during `implement` and step 1.g above (#1542) — the PR body is the ONLY place a close keyword should appear.
               Before creating the PR (whether via inline --body or --body-file), confirm the body text actually contains a Closes line per issue.
            c. mgr-gitnerd merges PR (admin merge required due to branch protection)
            d. DO NOT manually git tag or gh release create.