sshlg-skills 1.76.4 → 1.78.0

package/CHANGELOG.md

@@ -1,3 +1,47 @@
+## v1.78.0 (2026-10-24): quiet core skills listed by name only
+
+- **B-254:** `visibility` lists quiet core skills by name only on Claude Code. Measured
+  2026-10-24 on Claude Code 2.1.299: `Skill listing over budget: 132 skills, 61725 chars > 30000
+  budget`; over budget the host keeps bundled skills whole, gives the rest their description
+  most-used first and lists the remainder by name. A personal skill in the core that was not
+  used within 14 days and is not named in `~/.claude/CLAUDE.md` now gets
+  `skillOverrides: "name-only"` (on this machine 22 skills, the launcher's estimate 46,402 to
+  35,853 characters). `--full-days N|off`; ownership of each value is recorded
+  (`claudeNameOnly`), `--revert` removes only values still as written, and `update` re-applies
+  the tier only after an `--apply` that recorded `fullDays`. The listing estimate now counts
+  Claude's `- name: description` form, and the preview prints Claude Code's own last count
+  from its debug logs. `test/visibility_test.js` 22 to 29 checks,
+  `test/visibility_e2e_test.js` 11 to 15. Release impact card:
+  `docs/evidence/specs/2026-10-24-v1780-release-impact.md`.
+- **Context audit, the same request:** B-255 (the listing still over budget: family and foreign
+  plugin descriptions) and B-256 (the 15,410-character routing block in every host file) are
+  open rows with their measurements; oversized project instruction files are tracked in the
+  HANDOFF entry.
+
+## v1.77.0 (2026-10-24): every release with users carries its impact card
+
+- **Pins:** task-pipeline 1.102.0, the release impact card (operator, 2026-10-24): a release in a
+  project with users owes, before its tag, publish or deploy, a card naming who is affected and
+  how, the tracking that shows it going well with a watch window, the alert that fires when it
+  does not, and the rollback or hotfix with its decision trigger; stage 8 watches it
+  (`scripts/release_impact.py`, 47 cases); its own release carries the first card. Also B-155.
+  Member releases of what merged since their last tags (the family member gate and docs):
+  super-ux 0.66.1, sheleg-design 1.66.3, sheleg-dev 0.16.1, agent-sync 1.23.1, make-skill 0.33.1,
+  web3d-dev 0.2.3, xr-dev 0.4.3.
+
+- **#267 closed:** `update` rolled telegram-dev back because one of its local scopes is a
+  subdirectory of a git repository (`sshlg-personal-os/apps/adops-bot`). Measured in a scratch
+  HOME on Claude Code 2.1.299: a local-scope update run in a repository's subdirectory moves the
+  repository root's record and leaves the subdirectory's unchanged, the B-251 worktree case
+  widened. The planner now resolves the address Claude uses (`claudeAddress()`: the repository
+  root, a worktree's main tree, or the directory itself outside a repository) and leaves a record
+  whose path differs from its address as recorded beside a recorded root, or blocks the member by
+  name without one. `test/claude_pinned_test.js` 37 to 40 cases.
+- **B-253 closed:** the hygiene guard's `executablePart()` no longer drops text the shell would
+  still run: the `$(...)` and backtick substitutions in an unquoted-delimiter heredoc body fed to
+  a non-shell stay executable, and a `#` line inside a quote left open from an earlier line is
+  not a comment. `lib/guard.js` and `lib/repogate.js`, which reuse it, inherit the fix.
+
 ## v1.76.4 (2026-10-24): seo-aeo-audit pinned to 0.32.2
 
 - **seo-aeo-audit 0.32.2** (was 0.32.0), commit `08a57df`: `references/playbooks.md` grows. PB5

package/README.md

@@ -46,17 +46,17 @@ scripts. No services, no telemetry, no API keys.
 
 | Skill | Version | What it does |
 |---|---|---|
-| **[super-ux](https://github.com/ssheleg/super-ux)** | 0.66.0 | Scenario-driven UI development. A versioned design chain in `docs/ux/` — the product vision → personas and jobs → user flows → a screens-and-states map with Figma frames → traced scenarios → evidence-backed audits → fix plans, plus `docs/brand/` for how the product speaks. One `/ux` entry point that reaches every skill, two doc-drift linters and a contract doctor. |
-| **[task-pipeline](https://github.com/ssheleg/task-pipeline)** | 1.101.1 | Full-cycle delivery orchestrator. An intake grill interrogates the request into a complete brief, then **ten gated stages** carry it — docs, brainstorm and decompose, spec, plan, build, tests, deploy, post-deploy, wiki, acceptance — refusing to advance until each gate passes. Documentation is a deliverable with its own portable gate, and the retrospective it leaves behind is traceable to the commit that earned each lesson. Ships `project-audit`: a cold-start audit of a whole project — discovery, probes whose unmet needs read `blind` rather than clean, production evidence including one artefact served under two channels, and an HTML report beside a JSON sidecar that says what moved. |
-| **[agent-sync](https://github.com/ssheleg/agent-sync)** | 1.23.0 | Several agents, one repository, no collisions. Leases with a TTL so two agents cannot claim the same work, race-free id reservation, a run journal and a generated board — over a pluggable knowledge cloud. The answer to "two sessions just committed over each other". |
-| **[make-skill](https://github.com/ssheleg/make-skill)** | 0.33.0 | A skill that builds skills. Create, retrofit, audit and publish agent skills and Claude Code plugins: conformance to the [Agent Skills](https://agentskills.io/specification) open standard, [Anthropic's platform rules](https://platform.claude.com/docs/en/agents-and-tools/agent-skills/overview) (per-surface runtime limits, the Skills API, evals) and the [Claude Code plugin reference](https://code.claude.com/docs/en/plugins-reference), marketplace layout, version sync, validator + CI, every distribution channel, the review checklist for third-party skills, and what a *skill author* must know about MCP and A2A — the protocols themselves live in `agent-stack`. |
-| **[sheleg-design](https://github.com/ssheleg/sheleg-design-skill)** | 1.66.2 | The taste layer. Cinematic scroll-driven landing pages — one scroll clock, motion that degrades to calm, WebGL particle formations — plus product-UI style packs each shipping a ready token layer, and the Figma border: tokens as variables, design to code without hand-copied values. |
+| **[super-ux](https://github.com/ssheleg/super-ux)** | 0.66.1 | Scenario-driven UI development. A versioned design chain in `docs/ux/` — the product vision → personas and jobs → user flows → a screens-and-states map with Figma frames → traced scenarios → evidence-backed audits → fix plans, plus `docs/brand/` for how the product speaks. One `/ux` entry point that reaches every skill, two doc-drift linters and a contract doctor. |
+| **[task-pipeline](https://github.com/ssheleg/task-pipeline)** | 1.102.0 | Full-cycle delivery orchestrator. An intake grill interrogates the request into a complete brief, then **ten gated stages** carry it — docs, brainstorm and decompose, spec, plan, build, tests, deploy, post-deploy, wiki, acceptance — refusing to advance until each gate passes. Documentation is a deliverable with its own portable gate, and the retrospective it leaves behind is traceable to the commit that earned each lesson. Ships `project-audit`: a cold-start audit of a whole project — discovery, probes whose unmet needs read `blind` rather than clean, production evidence including one artefact served under two channels, and an HTML report beside a JSON sidecar that says what moved. |
+| **[agent-sync](https://github.com/ssheleg/agent-sync)** | 1.23.1 | Several agents, one repository, no collisions. Leases with a TTL so two agents cannot claim the same work, race-free id reservation, a run journal and a generated board — over a pluggable knowledge cloud. The answer to "two sessions just committed over each other". |
+| **[make-skill](https://github.com/ssheleg/make-skill)** | 0.33.1 | A skill that builds skills. Create, retrofit, audit and publish agent skills and Claude Code plugins: conformance to the [Agent Skills](https://agentskills.io/specification) open standard, [Anthropic's platform rules](https://platform.claude.com/docs/en/agents-and-tools/agent-skills/overview) (per-surface runtime limits, the Skills API, evals) and the [Claude Code plugin reference](https://code.claude.com/docs/en/plugins-reference), marketplace layout, version sync, validator + CI, every distribution channel, the review checklist for third-party skills, and what a *skill author* must know about MCP and A2A — the protocols themselves live in `agent-stack`. |
+| **[sheleg-design](https://github.com/ssheleg/sheleg-design-skill)** | 1.66.3 | The taste layer. Cinematic scroll-driven landing pages — one scroll clock, motion that degrades to calm, WebGL particle formations — plus product-UI style packs each shipping a ready token layer, and the Figma border: tokens as variables, design to code without hand-copied values. |
 | **[seo-aeo-audit](https://github.com/ssheleg/seo-aeo-audit)** | 0.32.2 | Evidence-first website audit for search **and** answer engines. Ten tracks from crawl access to AI citation mechanics; every finding carries an observation, every recommendation an evidence tier, and the output is a prioritized change plan plus a link-building brief, not a score. Before a site is built, `/seo-aeo-audit brief` writes the build-time brief that the audit later verifies. |
-| **[sheleg-dev](https://github.com/ssheleg/sheleg-dev)** | 0.16.0 | The integration layer a product reaches once it has users: **money in, tracking, sign-in, speed**. Stripe subscription billing reconciled into your own database — webhook idempotency, renewals, seats and proration, refunds, price drift, and the coupon offered at the cancel step, where a `duration=once` discount leaves `subscription.discounts` the moment its invoice finalizes and the offer can be taken every cycle; crypto payments that survive under-payment, duplicate webhooks and rate drift; GA4, Google Ads, Meta and LinkedIn under Consent Mode v2; Google sign-in with the account pre-hijacking guard, and the server-side auth surface behind it; Core Web Vitals work that moves the score rather than the report; and Sentry error tracking wired so it does not forward your own credentials to a third party and so a stack trace names the commit that caused it. |
+| **[sheleg-dev](https://github.com/ssheleg/sheleg-dev)** | 0.16.1 | The integration layer a product reaches once it has users: **money in, tracking, sign-in, speed**. Stripe subscription billing reconciled into your own database — webhook idempotency, renewals, seats and proration, refunds, price drift, and the coupon offered at the cancel step, where a `duration=once` discount leaves `subscription.discounts` the moment its invoice finalizes and the offer can be taken every cycle; crypto payments that survive under-payment, duplicate webhooks and rate drift; GA4, Google Ads, Meta and LinkedIn under Consent Mode v2; Google sign-in with the account pre-hijacking guard, and the server-side auth surface behind it; Core Web Vitals work that moves the score rather than the report; and Sentry error tracking wired so it does not forward your own credentials to a third party and so a stack trace names the commit that caused it. |
 | **[agent-stack](https://github.com/ssheleg/agent-stack)** | 0.31.2 | Production patterns for agent systems, in four skills. **The orchestrator** — tool-calling loops that survive their own context pressure, pipelines with human checkpoints and resume, provider routing with fallback and health checks, memory architecture — form, function and dynamics, the four-stage retrieval pipeline, and what a layer table alone cannot say, and **the shape of the work decided before the work**: an edge that carries no data is no edge, a plan that declares its dependencies is executed in layers rather than in list order, and a parallel layer gets a checker before the node that consumes it. **The harness** — what the agent is *told*: system prompts at the right altitude, tool descriptions the model can act on, technique choice with a verdict each, workflow versus agent and static versus dynamic, plus a seven-track audit of an agent somebody else built and a scanner for the defects that are mechanically visible. **The evals** — suites that measure whether it actually works: judging trajectories, regression fixtures grown from production, judges calibrated before they are trusted. **The interop layer** — MCP at revision 2026-07-28 and the four features it deprecated, running many servers at once, the registry, A2A 1.0, and the gateway, every reference carrying the spec revision it was read against. Plus the wallet side of reselling LLM access: tiered balances, one markup boundary, two-phase commit against a provider API. |
 | **[telegram-dev](https://github.com/ssheleg/telegram-dev)** | 0.5.3 | Telegram, split by the API each surface actually speaks. **`telegram-bots`** — the official HTTP Bot API: `update_id` as the only idempotency key an update carries, the `allowed_updates` default that subscribes you to everything *except* `chat_member` and the two reaction types while answering `ok: true`, the webhook secret header that is the real check, rate limits as a design constraint (1/sec per chat, 20/min per group, ~30/sec bulk), and Telegram Stars with a **ten-second** pre-checkout window and a grant that belongs to `successful_payment`. **`telegram-userbots`** — MTProto and Telethon: the session file as a credential equal to the password, `FloodWaitError` as the API telling you exactly how long to wait, pinning across minor releases that move session and entity-cache behaviour, and the account-ban risk a bot token does not carry — the skill opens with whether a user account is needed at all. **`telegram-miniapps`** — the web layer, whose entire security model is one signed query string: verifying `initData` server-side, the `auth_date` window, the Ed25519 path for a third party, and the SDK package whose name moved while the organisation's own page still fronts the old one. Both the verifier and the delivery invariants ship as runnable fixtures with their mutants, and a bot under load has its own reference: a poll that never waits on a handler, a queue per chat under one ceiling, payments outside it, guards measured from arrival, a bounded shutdown, with a discrete-event simulation whose nine invariants each go red without their rule. |
-| **[xr-dev](https://github.com/ssheleg/xr-dev)** | 0.4.2 | **`quest-lifecycle`** maps the product from platform choice through design, build, testing, Store, monetization, launch and operation. The existing owners cover native OpenXR, Kotlin Spatial/hybrid apps, measured rendering optimization, current-source/tool discovery, commercial and asset readiness, and WebXR/PWA. Every stage names evidence and a next action; Meta engine companions and official Godot XR documentation supply implementation detail. |
-| **[web3d-dev](https://github.com/ssheleg/web3d-dev)** | 0.2.2 | Realtime 3D on the web with three.js and React Three Fiber, split by the question. **`web3d-runtime`** — how the scene runs: WebGPURenderer and its WebGL2 fallback, TSL and compute, post-processing, device loss and profiling, led by the failures r186 keeps silent: `render()` before `init()` throws, `positionNode` collapses every instance to a point, `computeAsync` does not wait for the GPU, and about twenty drei components do not run on WebGPU. **`web3d-assets`** — the glTF pipeline from a source to the frame within a written budget: gltf-transform and gltfpack, KTX2 and meshopt, the loader that reads the result, sourcing and the four licence questions; it delegates orders to the asset service when the machine runs one and works by the same principles when not. **`web3d-animation`** — a two-sided animation protocol with a shared clip canon: rig, clips, blending, retargeting, root motion, crowds and vertex-animation textures. Every fact is pinned to three@0.186.1, and the gate checks each code block against that release's exports. |
+| **[xr-dev](https://github.com/ssheleg/xr-dev)** | 0.4.3 | **`quest-lifecycle`** maps the product from platform choice through design, build, testing, Store, monetization, launch and operation. The existing owners cover native OpenXR, Kotlin Spatial/hybrid apps, measured rendering optimization, current-source/tool discovery, commercial and asset readiness, and WebXR/PWA. Every stage names evidence and a next action; Meta engine companions and official Godot XR documentation supply implementation detail. |
+| **[web3d-dev](https://github.com/ssheleg/web3d-dev)** | 0.2.3 | Realtime 3D on the web with three.js and React Three Fiber, split by the question. **`web3d-runtime`** — how the scene runs: WebGPURenderer and its WebGL2 fallback, TSL and compute, post-processing, device loss and profiling, led by the failures r186 keeps silent: `render()` before `init()` throws, `positionNode` collapses every instance to a point, `computeAsync` does not wait for the GPU, and about twenty drei components do not run on WebGPU. **`web3d-assets`** — the glTF pipeline from a source to the frame within a written budget: gltf-transform and gltfpack, KTX2 and meshopt, the loader that reads the result, sourcing and the four licence questions; it delegates orders to the asset service when the machine runs one and works by the same principles when not. **`web3d-animation`** — a two-sided animation protocol with a shared clip canon: rig, clips, blending, retargeting, root motion, crowds and vertex-animation textures. Every fact is pinned to three@0.186.1, and the gate checks each code block against that release's exports. |
 
 They compose. `task-pipeline` hands user-facing work to `super-ux` and takes its
 leases from `agent-sync`; `make-skill` encodes the repo layout the others are
@@ -686,6 +686,17 @@ hides every other installed pack; an existing file is replaced only with `--repl
   so a plugin's skills stay listed (switch a foreign plugin off with `enabledPlugins`).
   The pack marks and the overrides below do not change them; `--keep <skill>` keeps a
   skill listed there.
+- **Claude Code name-only tier** (B-254, since v1.78.0): a personal skill in the core that
+  was not used within 14 days and is not named in `~/.claude/CLAUDE.md` stays listed by name
+  without its description (`skillOverrides: "name-only"`). Claude Code 2.1.299 does the same
+  on its own once the listing is over budget (bundled skills whole, the others' descriptions
+  most-used first, the rest by name), so this picks the quiet ones by the operator's usage
+  instead of the host's order. `--full-days N` sets the window, `--full-days off` turns the
+  tier off. `update` re-applies it only after one `visibility --apply` that recorded
+  `fullDays`; an older record re-applies without it. The preview prints the launcher's
+  estimate of the listing and Claude Code's own last count from its debug logs (the one
+  `Skill listing over budget` line); the estimate leaves out bundled skills, plugin commands
+  and plugins loaded from other roots, so the logged count is the one to trust.
 - **Gemini, Pi, OpenCode and Hermes** hide the skills of marked packs, except the usage
   core. Strongest first: a family pack is never hidden; the usage core is never hidden
   (family skills, skills used in the last 60 days by Claude Code usage, skills
@@ -698,12 +709,13 @@ hides every other installed pack; an existing file is replaced only with `--repl
 npx sshlg-skills config set visibility.pack.anthropics/financial-services show   # or hide, or default
 npx sshlg-skills visibility            # preview: per-host counts, nothing written
 npx sshlg-skills visibility --apply    # write each host's own switch, backups first; records consent
+npx sshlg-skills visibility --apply --full-days off   # Claude: keep every core description
 npx sshlg-skills visibility --revert   # remove exactly what --apply wrote; withdraws consent
 ```
 
 | Host | The switch `visibility` writes | Source | A hidden skill can still |
 |---|---|---|---|
-| Claude Code | `skillOverrides: "user-invocable-only"` in `~/.claude/settings.json`; plugin skills are out of its reach | since v1.55.0; Claude Code settings reference: overrides do not apply to plugin skills | be run from the `/` menu by a person |
+| Claude Code | `skillOverrides: "user-invocable-only"` (hidden) or `"name-only"` (quiet core) in `~/.claude/settings.json`; plugin skills are out of its reach | since v1.55.0; Claude Code settings reference: overrides do not apply to plugin skills | be run from the `/` menu by a person |
 | Codex | `enabled = false` entries in `~/.codex/config.toml` `[skills] config` | since v1.55.0 | be read from its SKILL.md path when asked |
 | Gemini CLI 0.63.0 | `skills.disabled` in `~/.gemini/settings.json`, the list `gemini skills disable <name> --scope user` writes; read back with `gemini skills list` (`[Disabled]`) | `packages/cli/src/utils/skillSettings.ts`; `SkillManager.getSkills()` drops disabled skills | come back with `gemini skills enable <name>` |
 | Pi 1.1.0 | `-<path>` exact exclusions in the `skills` array of `~/.pi/agent/settings.json`, one per folder holding the skill (`~/.agents/skills`, `~/.pi/agent/skills`); the file is created if absent and removed again by `--revert` | Pi's own docs, settings → Resources; `isEnabledByOverrides` in its `dist/core/package-manager.js` | be loaded for one session with `pi --skill <path>` |

package/bin/sshlg-skills.js

@@ -314,8 +314,9 @@ Usage:
                                                       # report header + footer, links looked up
   npx sshlg-skills toolkit [--for "<task>"] [--find "<concept>, …"] [--expand <provider>]
                                                       # every skill this machine can reach
-  npx sshlg-skills visibility [--apply | --revert] [--days 60] [--keep a,b]
+  npx sshlg-skills visibility [--apply | --revert] [--days 60] [--full-days 14|off] [--keep a,b]
                                                       # Claude/Codex: hide all outside the core;
+                                                      # Claude: quiet core skills name-only;
                                                       # Gemini/Pi/OpenCode/Hermes: hide marked
                                                       # packs; Cursor/Kimi: cannot hide
   npx sshlg-skills visibility marks [--init --show <owner/repo,…> [--replace] [--apply]]
@@ -773,6 +774,9 @@ function reapplyVisibility(f) {
   log(`\n== Skill visibility (re-applied: this machine ran \`visibility --apply\`; hosts: ${[...only].join(', ')}) ==`);
   return runVisibility({
     mode: 'apply', days: Number(rec.days) || undefined, keep: Array.isArray(rec.keep) ? rec.keep : [], only, reapply: true,
+    // A record from before the name-only tier carries no fullDays: re-apply keeps the old
+    // behaviour until the operator runs `visibility --apply` once (B-254, explicit consent).
+    fullDays: typeof rec.fullDays === 'number' ? rec.fullDays : null,
   }) === 0;
 }
 
@@ -2139,9 +2143,19 @@ function cmdVisibility(argv) {
     mode: flag('--revert') ? 'revert' : flag('--apply') ? 'apply' : 'preview',
     days: Number(value('--days')) || V.DEFAULT_DAYS,
     keep: (value('--keep') || '').split(',').map((s) => s.trim()).filter(Boolean),
+    fullDays: fullDaysArg(value('--full-days'), V.DEFAULT_FULL_DAYS),
   });
 }
 
+/** `--full-days N` (a whole number of days), `--full-days off` (no name-only tier), or the default. */
+function fullDaysArg(raw, dflt) {
+  if (raw === null) return dflt;
+  if (raw === 'off') return null;
+  const n = Number(raw);
+  if (!Number.isInteger(n) || n < 0) { log(`visibility: --full-days takes a whole number of days or "off", got "${raw}"; using ${dflt}`); return dflt; }
+  return n;
+}
+
 /**
  * The work of `visibility`, callable from `update` (which re-applies it on a machine whose
  * record shows the operator ran `--apply`). `opts.only` limits the run to a set of host
@@ -2163,6 +2177,29 @@ function runVisibility(opts) {
   finally { lock.release(home, got.token); }
 }
 
+/**
+ * Claude Code's own last listing count, read from its debug logs (newest first). Only the
+ * one warning line is parsed; nothing else in a log is read into the output.
+ */
+function lastListingMeasure(claudeRoot) {
+  const dir = path.join(claudeRoot, 'debug');
+  let files = [];
+  try {
+    files = fs.readdirSync(dir).filter((n) => n.endsWith('.txt'))
+      .map((n) => ({ n, m: fs.statSync(path.join(dir, n)).mtimeMs })).sort((a, b) => b.m - a.m).slice(0, 40);
+  } catch (e) { return null; }
+  const re = /^(\S+) \[WARN\] Skill listing over budget: (\d+) skills, (\d+) chars > (\d+) budget/m;
+  for (const f of files) {
+    let text;
+    try { text = fs.readFileSync(path.join(dir, f.n), 'utf8'); } catch (e) { continue; }
+    const all = text.match(new RegExp(re.source, 'gm'));
+    if (!all) continue;
+    const m = re.exec(all[all.length - 1]);
+    return { at: m[1], skills: Number(m[2]), chars: Number(m[3]), budget: Number(m[4]) };
+  }
+  return null;
+}
+
 function runVisibilityUnlocked(opts) {
   const V = require(path.join(ROOT, 'lib', 'visibility.js'));
   const HV = require(path.join(ROOT, 'lib', 'hostvis.js'));
@@ -2179,6 +2216,8 @@ function runVisibilityUnlocked(opts) {
   const doRevert = opts.mode === 'revert';
   const days = opts.days || V.DEFAULT_DAYS;
   const keep = opts.keep || [];
+  // null: no name-only tier (a re-apply of a record that predates it, or `--full-days off`).
+  const fullDays = typeof opts.fullDays === 'number' ? opts.fullDays : null;
   const inScope = (id) => !opts.only || opts.only.has(id);
 
   const recordPath = path.join(home, '.sshlg-skills', 'visibility.json');
@@ -2226,11 +2265,24 @@ function runVisibilityUnlocked(opts) {
   try { settingsData = JSON.parse(settingsText || '{}'); } catch (e) { settingsData = {}; }
   const overrides = settingsData.skillOverrides || {};
   const mine = new Set(owned.claude.filter((n) => overrides[n] === V.HIDE));
+  const ownedNameOnly = Array.isArray(owned.claudeNameOnly) ? owned.claudeNameOnly : [];
+  const mineNameOnly = new Set(ownedNameOnly.filter((n) => overrides[n] === V.NAME_ONLY));
   const foreign = {};
-  for (const [k, v] of Object.entries(overrides)) if (!mine.has(k)) foreign[k] = v;
-  const plan = doRevert ? { hide: [], respected: [] } : V.claudePlan({ personal, core: coreSet, overrides: foreign, keep });
-  const claudeSet = plan.hide.filter((n) => !mine.has(n));
-  const claudeUnset = [...mine].filter((n) => !plan.hide.includes(n));
+  for (const [k, v] of Object.entries(overrides)) if (!mine.has(k) && !mineNameOnly.has(k)) foreign[k] = v;
+  const full = doRevert || fullDays === null ? null
+    : V.fullSet({ personal, usage, now, fullDays, instructions });
+  const plan = doRevert ? { hide: [], nameOnly: [], respected: [] }
+    : V.claudePlan({ personal, core: coreSet, full, overrides: foreign, keep });
+  // Values this run writes, and values it removes (only while they still hold what it wrote).
+  const claudeSetMap = {};
+  for (const n of plan.hide) if (overrides[n] !== V.HIDE) claudeSetMap[n] = V.HIDE;
+  for (const n of plan.nameOnly) if (overrides[n] !== V.NAME_ONLY) claudeSetMap[n] = V.NAME_ONLY;
+  const planned = new Set(plan.hide.concat(plan.nameOnly));
+  const claudeUnsetMap = {};
+  for (const n of mine) if (!planned.has(n)) claudeUnsetMap[n] = V.HIDE;
+  for (const n of mineNameOnly) if (!planned.has(n)) claudeUnsetMap[n] = V.NAME_ONLY;
+  const claudeSet = Object.keys(claudeSetMap);
+  const claudeUnset = Object.keys(claudeUnsetMap);
   const stateOf = (s, ov) => {
     if (s.loaded === false) return 'hidden';  // installed, not loaded here (B-185): not in the listing
     if (s.namespace !== 'claude:plain') return 'on';
@@ -2239,7 +2291,7 @@ function runVisibilityUnlocked(opts) {
     return v === 'name-only' ? 'name-only' : 'on';
   };
   const after = Object.assign({}, overrides);
-  for (const n of claudeSet) after[n] = V.HIDE;
+  for (const n of claudeSet) after[n] = claudeSetMap[n];
   for (const n of claudeUnset) delete after[n];
   const charsBefore = V.listingChars(skills.map((s) => ({ name: s.plugin && s.namespace === 'claude:plugin' ? `${s.plugin.split('@')[0]}:${s.id}` : s.id, description: s.description, state: stateOf(s, overrides) })));
   const charsAfter = V.listingChars(skills.map((s) => ({ name: s.plugin && s.namespace === 'claude:plugin' ? `${s.plugin.split('@')[0]}:${s.id}` : s.id, description: s.description, state: stateOf(s, after) })));
@@ -2336,11 +2388,21 @@ function runVisibilityUnlocked(opts) {
     log(`  overrides (config.json): hidePacks ${(ov.hidePacks || []).length}, showPacks ${(ov.showPacks || []).length} — Gemini, Pi, OpenCode and Hermes only`);
   }
   if (inScope('claude')) {
-    log(`  Claude: ${personal.length} personal skills; hide ${claudeSet.length} more, un-hide ${claudeUnset.length}; ` +
+    const newHides = claudeSet.filter((n) => claudeSetMap[n] === V.HIDE).length;
+    log(`  Claude: ${personal.length} personal skills; hide ${newHides} more, name-only ${claudeSet.length - newHides} more, restore ${claudeUnset.length}; ` +
         `${Object.keys(foreign).length} operator-set override(s) left alone`);
-    log(`  Claude listing ≈ ${charsBefore} → ${charsAfter} characters (names + descriptions, 1536 cap each).`);
-    log('    Budget: Claude Code logs it — `claude -p x --debug` then look for "Skill listing over budget"');
-    log('    (30000 characters measured on 2026-10-10). Over budget, descriptions drop least-used first.');
+    log(fullDays === null
+      ? '    name-only tier: off (`--full-days N` turns it on: core skills unused for N days keep their name, lose their description)'
+      : `    name-only tier: core skills not used within ${fullDays} days and not named in the instructions are listed by name only (${plan.nameOnly.length})`);
+    log(`  Claude listing, launcher's estimate ≈ ${charsBefore} → ${charsAfter} characters`);
+    log('    (personal and registered plugin skills in Claude\'s `- name: description` form; bundled skills,');
+    log('    plugin commands and plugins loaded from other roots are not counted).');
+    const measured = lastListingMeasure(claudeRoot);
+    log(measured
+      ? `    Claude Code's own count (debug log ${measured.at}): ${measured.skills} entries, ${measured.chars} characters > ${measured.budget} budget.`
+      : '    Claude Code\'s own count: none logged yet. `claude -p x --debug`, then look for "Skill listing over budget".');
+    log('    Over budget, Claude Code 2.1.299 keeps bundled skills whole, gives the others their description');
+    log('    most-used first and lists the rest by name only.');
   }
   if (inScope('codex')) {
     log(`  Codex: ${shared.length} shared skills; disable up to ${codexAdd.length} more (entries already present are left as they are), re-enable ${codexDrop.length}` +
@@ -2404,7 +2466,7 @@ function runVisibilityUnlocked(opts) {
   const degraded = [];
   let record = Object.assign({}, owned, {
     note: 'Written by `npx sshlg-skills visibility`; --revert removes these entries. Pending holds a write-ahead receipt; applied is consent for update on hosts only.',
-    days, keep, marksRevision: marksData && !markProblems.length ? marksData.revision : null,
+    days, keep, fullDays, marksRevision: marksData && !markProblems.length ? marksData.revision : null,
     updatedAt: new Date().toISOString(), created: Object.assign({}, owned.created || {}),
     files: Object.assign({}, owned.files || {}, Object.fromEntries(Object.entries(files).filter(([id]) => inScope(id)))),
   });
@@ -2442,13 +2504,14 @@ function runVisibilityUnlocked(opts) {
       if (id === 'claude') {
         if (claudeSet.length && !('skillOverrides' in settingsData)) next.created.claude = ['skillOverrides'];
         if (doRevert) delete next.created.claude;
+        next.claudeNameOnly = plan.nameOnly.slice().sort();
       }
       if (r.text === before) { journal.save(next); log(`  ${id}: already as planned`); return; }
       transact(id, file, before, r.text, next, () => S.write(file, r.text, home));
     };
     const claudeCreated = createdOf('claude').includes('skillOverrides') || !Object.prototype.hasOwnProperty.call(owned, 'applied');
     writeSimple('claude', settingsPath, settingsText,
-      (t) => V.editClaudeSettings(t, { set: claudeSet, unset: claudeUnset, prune: claudeCreated }), () => plan.hide.slice().sort());
+      (t) => V.editClaudeSettings(t, { set: claudeSetMap, unset: claudeUnsetMap, prune: claudeCreated }), () => plan.hide.slice().sort());
     writeSimple('codex', codexPath, codexText,
       (t) => V.editCodexConfig(t, { disable: codexAdd, enable: codexDrop }),
       (r) => [...new Set(owned.codex.filter((p) => codexWant.includes(p)).concat(r.added || []))].sort());

package/claude-plugin-pins.json

@@ -4,8 +4,8 @@
     {
       "name": "super-ux",
       "repo": "ssheleg/super-ux",
-      "commit": "13195c6402705cb656961fb04ca6d1f8c1df3fb0",
-      "version": "0.66.0",
+      "commit": "4965a0b5ff10bca27e7044d957f5cdb612841783",
+      "version": "0.66.1",
       "pluginInstall": "super-ux@super-ux",
       "pluginPath": "plugins/super-ux",
       "entry": {
@@ -13,7 +13,7 @@
         "displayName": "Super UX",
         "source": "./plugins/super-ux",
         "description": "Scenario-driven UI development: a versioned design chain in docs/ux/ — product vision -> personas, JTBD, journeys and stories -> user flows -> a screens+states UI map with Figma frames -> traced use-case scenarios -> evidence-backed audits -> concrete fix plans. Skills: vision, ux-foundation, ux-flows, ux-scenarios, ux-audit, brand-voice, copywriting. /ux is the single plain-language entry point and reaches every skill; a stdlib linter fails on doc drift; a tag-indexed best-practices catalog, PRN heuristics and component guidelines guide design; one style pack (via the sheleg-design companion) locks the visual identity.",
-        "version": "0.66.0",
+        "version": "0.66.1",
         "author": {
           "name": "ssheleg",
           "url": "https://x.com/sshlg93"
@@ -40,7 +40,7 @@
       "files": [
         {
           "path": ".claude-plugin/plugin.json",
-          "sha256": "42fd5c31e30c9df462bc7588731d2aa0e91de38d9e79bd039a165b163df345f8",
+          "sha256": "9a54d7d75b7d07030de41f0bfafff651b56cbf7063d0a2fcf4005f3b104d7635",
           "bytes": 1196
         },
         {
@@ -1073,8 +1073,8 @@
     {
       "name": "task-pipeline",
       "repo": "ssheleg/task-pipeline",
-      "commit": "c914a84d1240caef00c8ed4342b0ef3eddf4f5b0",
-      "version": "1.101.1",
+      "commit": "34251bff4ab67bbaed8e290884327f03ad646ad8",
+      "version": "1.102.0",
       "pluginInstall": "task-pipeline@task-pipeline",
       "pluginPath": "plugins/task-pipeline",
       "entry": {
@@ -1082,7 +1082,7 @@
         "displayName": "Task Pipeline",
         "source": "./plugins/task-pipeline",
         "description": "Runs a substantial task through a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine is built into the skill — no companion plugin required — with typed auto/judgment/manual gates, a frozen requirement spine that closes with evidence, a work board and a verification ledger that outlive a run, an exposure line naming what shipped unconfirmed, a progress rail computed from the project's own config, a proportional short path for small changes, a loop guard whose ceilings stop and record a blocker, and stage-3 tracks for what a product does, how it sounds and how it looks. Two modes need no task: `checkup` (what is unverified) and `setup` (audit existing docs); a third, `waves`, takes the whole board and closes it in waves that each finish in one pass. Retro insights can publish upstream as issues, opt-in and redacted.",
-        "version": "1.101.1",
+        "version": "1.102.0",
         "author": {
           "name": "ssheleg",
           "url": "https://x.com/sshlg93"
@@ -1105,7 +1105,7 @@
       "files": [
         {
           "path": ".claude-plugin/plugin.json",
-          "sha256": "27aebdde4177506522664b4722111876ad30f2eeca938dfde28d25433ce7e625",
+          "sha256": "0646241836573d8a111f38f4edb57d1d15621da1bfbaab7405ad14c1a9793ba4",
           "bytes": 1529
         },
         {
@@ -1305,13 +1305,13 @@
         },
         {
           "path": "skills/task-pipeline/pipeline.example.json",
-          "sha256": "253d7f3b83516933660b61e55b8756019caae182d759a2f1c5a21af9a0aba6d4",
-          "bytes": 25974
+          "sha256": "e6caf3c47a5638d6bfdda19f16a58d3a8edc53a891c6363956d05e9febedaeb2",
+          "bytes": 25999
         },
         {
           "path": "skills/task-pipeline/pipeline.schema.json",
-          "sha256": "4a123f1f501184a45de225e3568d60de0510b50d9b9e91e703b46d3e8550a930",
-          "bytes": 22920
+          "sha256": "52739da82583aa96740359e6b3c3c6e9399d3f8c95df875e746fc460f1baf144",
+          "bytes": 23552
         },
         {
           "path": "skills/task-pipeline/references/acceptance.md",
@@ -1325,8 +1325,8 @@
         },
         {
           "path": "skills/task-pipeline/references/artifacts.md",
-          "sha256": "49f82f9895b5e5df86471a1122d46adccdbccb3846f23485d815442e19af3044",
-          "bytes": 20165
+          "sha256": "aa20a00752c9f5403212081cec24532da23f2aef5165827a448832b8c1bf84f9",
+          "bytes": 20513
         },
         {
           "path": "skills/task-pipeline/references/audit.md",
@@ -1390,8 +1390,8 @@
         },
         {
           "path": "skills/task-pipeline/references/doctrine-map.md",
-          "sha256": "1928796d40bb9a9f4f2ec360063ad6d5101accbdb3755f62399beb90f5f9a880",
-          "bytes": 5350
+          "sha256": "680452be2e1eadd42d7180ffeeaff2eb432b213e4dc4408f2d76bfc6de8e83fa",
+          "bytes": 5543
         },
         {
           "path": "skills/task-pipeline/references/documentation.md",
@@ -1460,8 +1460,8 @@
         },
         {
           "path": "skills/task-pipeline/references/portability.md",
-          "sha256": "e9c039c741b743ed3ee0d93459773210fa79daeae9f55e2136aa5ceb1f113d48",
-          "bytes": 12060
+          "sha256": "309fb98d58e9dc71ea3d3fd9f185371c70e745fbb42bc45614d015525a18691b",
+          "bytes": 12313
         },
         {
           "path": "skills/task-pipeline/references/prioritisation.md",
@@ -1478,6 +1478,11 @@
           "sha256": "216f5d195c8b99aa7113d9fd19c6666b88b6b0cadd38eb93c840440fbabbb6eb",
           "bytes": 25540
         },
+        {
+          "path": "skills/task-pipeline/references/release-impact.md",
+          "sha256": "182135808e6db37647cfb30dadede0deceecf4f6bd69dc9aa99589c9aefa2d1c",
+          "bytes": 9909
+        },
         {
           "path": "skills/task-pipeline/references/residue.md",
           "sha256": "1c63c29404ef1200c492e823bbf464f08c7dea71cda79a9dbb9dfbc8c4dad991",
@@ -1540,13 +1545,13 @@
         },
         {
           "path": "skills/task-pipeline/references/stage-07-lint-deploy.md",
-          "sha256": "2a1eeb370e346a679d05b2e1670f0cd4a2e8ebc485538f92e63ec3b185d6f138",
-          "bytes": 936
+          "sha256": "6af757f8c22c4da3169600f3bb9bcf2f631411e8d676ad53b811fe154111bce3",
+          "bytes": 1444
         },
         {
           "path": "skills/task-pipeline/references/stage-08-post-deploy.md",
-          "sha256": "b2d1c70fe9261d62985c1356b5650df3006f0e4e7dd8534753d824f43899bd2a",
-          "bytes": 2002
+          "sha256": "bc10341cbc6b9356311ae62021a0182768930fc0221dcb142bf6d491262c79ab",
+          "bytes": 2465
         },
         {
           "path": "skills/task-pipeline/references/stage-09-docs-wiki.md",
@@ -1560,8 +1565,8 @@
         },
         {
           "path": "skills/task-pipeline/references/stages.md",
-          "sha256": "d45637faf55c26e1a9e2d25e2fa7fca6ead1153d6f9cab2d536e6bad9723aed1",
-          "bytes": 37900
+          "sha256": "cd2a737e30e96ef29a90c9d30790159a6eb88b223b524d46c46659d861498deb",
+          "bytes": 38987
         },
         {
           "path": "skills/task-pipeline/references/tdd.md",
@@ -1605,7 +1610,7 @@
         },
         {
           "path": "skills/task-pipeline/scripts/graph.py",
-          "sha256": "a0d6c501ef4bf17b0f93b66e828ea662b925682bea7f9fbf8ca481f06df8925f",
+          "sha256": "503afebfa1891badd0c5bf4dc7b41ee832021ddb1fdc5d0192d9cec507728a44",
           "bytes": 115059
         },
         {
@@ -1623,6 +1628,11 @@
           "sha256": "0c1c2a55b9907147c9f8f5dc9075f67b050df6d79581eef4dca4c89ec33e8728",
           "bytes": 17215
         },
+        {
+          "path": "skills/task-pipeline/scripts/release_impact.py",
+          "sha256": "b9a6803e5ddd23372b737e428211c5b092c72e05209d1988356c4475c8778cee",
+          "bytes": 11959
+        },
         {
           "path": "skills/task-pipeline/scripts/resource_guard.py",
           "sha256": "6a66cb6b1e2826b3825e4f8c18a995eaa9934deda4b24a4d9c98b8c44e143abc",
@@ -1765,8 +1775,13 @@
         },
         {
           "path": "skills/task-pipeline/templates/README.md",
-          "sha256": "664ba4d50bd4ec6c7d6351189efb5004d162956219c44b54841d3374c9b26380",
-          "bytes": 5560
+          "sha256": "cb2cdbd2d93d7bc8a06fc54d8b2d218b57d2911b7c7dc925320877c1e9733ee6",
+          "bytes": 5811
+        },
+        {
+          "path": "skills/task-pipeline/templates/release-impact.md",
+          "sha256": "7d3d2b9e693b9cf42e47ffbbcafd7b5e4f033bfdfa381762175de7a38664c295",
+          "bytes": 2141
         },
         {
           "path": "skills/task-pipeline/templates/retro-archive.md",
@@ -1785,7 +1800,7 @@
         },
         {
           "path": "skills/task-pipeline/templates/run.md",
-          "sha256": "126bfb4a4c18719eb41c485e830e1d40433f491b05a7e53a908214d930faedb0",
+          "sha256": "bd89a1680e6f861d435df9caf0685385fa3f1d7ff7fbea93c153fde2c3be0b8e",
           "bytes": 13120
         },
         {
@@ -1803,8 +1818,8 @@
     {
       "name": "agent-sync",
       "repo": "ssheleg/agent-sync",
-      "commit": "5c169af9097f8192fe8786014fb08b3e8fe2204d",
-      "version": "1.23.0",
+      "commit": "7c3f18aed38b4fa8d8c8d4d7da9df223141cb7ef",
+      "version": "1.23.1",
       "pluginInstall": "agent-sync@agent-sync",
       "pluginPath": "plugins/agent-sync",
       "entry": {
@@ -1812,7 +1827,7 @@
         "displayName": "Agent Sync",
         "source": "./plugins/agent-sync",
         "description": "Coordination layer for multi-agent repositories. Gives task-pipeline runs leases with a TTL, race-free ID reservation, a cross-repo signal feed, an append-only run journal and a machine-generated read-only board. A lease is decided by a primitive that genuinely has compare-and-swap — an atomic file create on one machine, a pushed git ref across machines — never by the knowledge base, which loses concurrent writes; the store carries the record and the ID allocation, which is positional over the merged log. The knowledge backend is a pluggable adapter (Outline, filesystem) declaring its own capabilities and degrading out loud. Ships Claude Code hooks that deny edits to guarded registry files without a live lease.",
-        "version": "1.23.0",
+        "version": "1.23.1",
         "author": {
           "name": "ssheleg",
           "url": "https://x.com/sshlg93"
@@ -1835,7 +1850,7 @@
       "files": [
         {
           "path": ".claude-plugin/plugin.json",
-          "sha256": "bca81db5728d6686d6664f3d248660e7155ad504a033eea65cbd4c43697b6291",
+          "sha256": "69b086ad9fa4b2a71efee43fc01302fe40aa16e377c17586d058553ab7ba8a5c",
           "bytes": 695
         },
         {
@@ -1935,7 +1950,7 @@
         },
         {
           "path": "skills/agent-sync/scripts/agent_sync.py",
-          "sha256": "fc35d561ff73efbb31be792f2bfe46e51d72bcc8b8a04627f07aa0bf377b33d0",
+          "sha256": "80a162732f4f8fe0cbca7df7355bbc757ed98e038d7e1ac9b2708de120b575d8",
           "bytes": 376420
         },
         {
@@ -1945,7 +1960,7 @@
         },
         {
           "path": "skills/agent-sync/SKILL.md",
-          "sha256": "6807c2cf0eb8e8ad675c8bf92d7eed550baeb8420442cdaf4002ab43a6b0c1e7",
+          "sha256": "d49b5b0dad05af9a988d0cc31ef483be2d1006d01b21e519afc44691764dcd0d",
           "bytes": 19971
         }
       ]
@@ -1953,8 +1968,8 @@
     {
       "name": "make-skill",
       "repo": "ssheleg/make-skill",
-      "commit": "7745e2c646c0642af8aa0796522867ba115a0f42",
-      "version": "0.33.0",
+      "commit": "c59b0761cb57c8a67bb35e18615ca6f77c08b170",
+      "version": "0.33.1",
       "pluginInstall": "make-skill@make-skill",
       "pluginPath": "plugins/make-skill",
       "entry": {
@@ -1962,7 +1977,7 @@
         "displayName": "Make Skill",
         "source": "./plugins/make-skill",
         "description": "Encodes the Agent Skills open standard AND Anthropic's platform rules (front-matter limits, disclosure budgets, per-surface runtime limits, the Skills API, evaluation-driven authoring) plus the Claude Code plugin reference (manifest schemas, component layout, `claude plugin validate --strict`) and the proven ssheleg pipeline: marketplace repo layout, version sync, validator + CI, multi-channel distribution (Claude Code plugin, vercel skills CLI, npx, Cursor), npm gotchas, end-to-end first publish, the review checklist for third-party skills, and MCP / A2A rules for protocol-connected skills.",
-        "version": "0.33.0",
+        "version": "0.33.1",
         "author": {
           "name": "ssheleg",
           "url": "https://x.com/sshlg93"
@@ -1990,7 +2005,7 @@
       "files": [
         {
           "path": ".claude-plugin/plugin.json",
-          "sha256": "0cab374d5d4bfc6d3a54a506170e3653fd6d2a7d48308ef4fbf815e25fa67f28",
+          "sha256": "9e7c1b71a83cb84b5cc4d37c0b6d1b266caeba63c3167252295d88a1e42320dc",
           "bytes": 1093
         },
         {
@@ -2110,12 +2125,12 @@
         },
         {
           "path": "skills/make-skill/SKILL.md",
-          "sha256": "7fbbdfe703da183be326b04b8842fb3e71b45b16624c701333ec3cb1fce900d1",
+          "sha256": "0e97e39e38c9bacdfc99c4a2744daada24a4820e40cdbae838fa86184e644ca5",
           "bytes": 19692
         },
         {
           "path": "skills/skill-search/SKILL.md",
-          "sha256": "79b79c7b65262400dc34e5f452668a1f7743d536301a05563d2ef2d67c0aba0b",
+          "sha256": "2cb5cbe4a884dcc14c77ae697f5ff4de548f3aad67d036482c37af42659f0773",
           "bytes": 3490
         }
       ]
@@ -2123,8 +2138,8 @@
     {
       "name": "sheleg-design",
       "repo": "ssheleg/sheleg-design-skill",
-      "commit": "9d8dd8b36362d38a112d726c459c31a38c2b6673",
-      "version": "1.66.2",
+      "commit": "f5743d2259da679a157e9d1c01b90e8e3e1d969a",
+      "version": "1.66.3",
       "pluginInstall": "sheleg-design@sheleg-design-skill",
       "pluginPath": "plugins/sheleg-design",
       "entry": {
@@ -2132,7 +2147,7 @@
         "displayName": "SHELEG Design",
         "source": "./plugins/sheleg-design",
         "description": "SHELEG Design methodology: cinematic scroll-driven landing pages (single scroll clock, layered degrade-to-calm motion, WebGL particle formations), a motion doctrine that decides whether to animate before it decides how, and thirty-nine pluggable visual style packs, each with a ready-made token layer — instrument-console (near-black aerospace console; technical systems and infrastructure), editorial-luxury (cream and espresso; editorial, research, premium B2B), workbench (quiet light/dark UI; dashboards, admin, internal tools), briefing-room (dark 16:9 deck; investor and board presentations), atrium (cream daylight; consumer health and high-trust DTC), babylove (white with orange; SEO SaaS, long time-to-value, disconnected states), patchbay (black with mint-cyan; engines, buses, pipelines, OSS front doors), nameplate (cool slab with coral; press, certification and third-party trust), rimlight (white with blue light; studios, services and case studies), onionskin (white working sheet; developer and AI infrastructure), deskmate (warm beige with a dusk bleed; AI coworkers and chat-native agents), test-drive (warm paper with one coral; self-serve SaaS proven by the live product), surveyor (peach paper with teal and pink; visibility, monitoring and benchmark tools), chorus (warm paper under a crosshair grid, with a cut-corner bubble; AI-search visibility, brand monitoring and community marketing), outrank (white with violet; one brand across marketing and product), orchard (warm oat slabs; friendly biotech and wellness), field-notes (ruled green paper; auditable open-source developer tools), showroom (white gallery; product-led companies selling the app), blueprint (white technical stock; vector, storage and query infrastructure), prism (iridescent hard edge; command-first OSS infrastructure), maquette (near-black table; enterprise data infrastructure), cyclorama (looping pastel field; applied-AI consultancies), scoreboard (warm paper; growth, ads and accumulating metrics), datasheet (off-white specification; fraud, identity and device intelligence), manpage (cream manual; APIs, SDKs, CLIs and MCP servers), pigeonhole (filed white field; inbox, ticket and CRM triage), roster (faint square grid; platforms sold through who uses them), ora (warm coal; machine verdicts, audits and protocol traces), tenor (warm management paper; agent operations and autonomous back office), ledger (cream ruled console; analysts, BI and warehouse agents), paperclip (monochrome coal; orchestrators, schedulers and job runners), awning (white commerce forecourt; storefront, payroll and billing platforms), router (pale console with hairlines; dashboard, billing and inventory surfaces), daylight (bright portal with one shadow; client onboarding and service portals), notation (restrained technical hairlines; OSS, docs and developer workspaces), almanac (oatmeal editorial paper; manifestos and category-defining pages), vitrine (serif trust display; evaluated B2B, security and compliance), proscenium (white demo sequence; product tours and launch pages), bulletin (cheerful outlined bands; broad SMB and agency platforms). Ships the sheleg-design skill, the architecture reference, the motion doctrine, the Figma and Claude Design bridges, AI-surface patterns, the packs' token CSS, and the /sheleg-design command.",
-        "version": "1.66.2",
+        "version": "1.66.3",
         "author": {
           "name": "ssheleg",
           "url": "https://x.com/sshlg93"
@@ -2159,7 +2174,7 @@
       "files": [
         {
           "path": ".claude-plugin/plugin.json",
-          "sha256": "c5ccd0f385217a5f5c69a80d8dc8ddc93b3ae9f36058c7617d13d96747a6a260",
+          "sha256": "42d48b7b499f73a53b4660f3d97a6a5253ab8ebafdeb575bb61e313f6ea59df7",
           "bytes": 3896
         },
         {
@@ -2244,7 +2259,7 @@
         },
         {
           "path": "skills/sheleg-design/SKILL.md",
-          "sha256": "3e3c5afea5716b27238a7b13eb728be7adcefe41562542b8d0b9b88e480cc0d1",
+          "sha256": "e1acc4d721e55a85c871a2172948e63405a393baa936ff2e7b8455565e5fa218",
           "bytes": 19980
         },
         {
@@ -2919,8 +2934,8 @@
     {
       "name": "sheleg-dev",
       "repo": "ssheleg/sheleg-dev",
-      "commit": "5842df5677ab330738ea5ef4c14add4f7dea089d",
-      "version": "0.16.0",
+      "commit": "fa5a739960973aaacabfe0fb5db8b4f5e856f232",
+      "version": "0.16.1",
       "pluginInstall": "sheleg-dev@sheleg-dev",
       "pluginPath": "plugins/sheleg-dev",
       "entry": {
@@ -2928,7 +2943,7 @@
         "displayName": "Sheleg Dev",
         "source": "./plugins/sheleg-dev",
         "description": "The integration layer a product needs once it has users: Stripe subscription billing reconciled into your own database, crypto payments that survive over-payment and duplicate webhooks, ad and conversion tracking under Consent Mode v2, Google sign-in with the account-linking guards, the wider Google auth surface, and Core Web Vitals work that moves the score, and Sentry error tracking wired so it does not forward your own credentials to a third party and so a stack trace names the commit that caused it.",
-        "version": "0.16.0",
+        "version": "0.16.1",
         "author": {
           "name": "ssheleg",
           "url": "https://x.com/sshlg93"
@@ -2957,7 +2972,7 @@
       "files": [
         {
           "path": ".claude-plugin/plugin.json",
-          "sha256": "4897cd65af1c37c75cd94c81324d2de8bb4973e0545f235a5c787ff7e0d83396",
+          "sha256": "89e576714f389c51efccc25512df9ca65a5576e46691dc4ded0e5a14f5109250",
           "bytes": 1221
         },
         {
@@ -3635,15 +3650,15 @@
     {
       "name": "xr-dev",
       "repo": "ssheleg/xr-dev",
-      "commit": "98e26301a664232cd27c6ad9737bb74547dd4e1a",
-      "version": "0.4.2",
+      "commit": "ba885bb48d2737902628c3a9e4d512379feb65c6",
+      "version": "0.4.3",
       "pluginInstall": "xr-dev@xr-dev",
       "pluginPath": "plugins/xr-dev",
       "entry": {
         "name": "xr-dev",
         "displayName": "XR Dev",
         "description": "Seven skills for the Meta Quest product lifecycle: platform and engine discovery, immersive design, native OpenXR, Kotlin Spatial and hybrid apps, WebXR/PWA, rendering experiments, tool and source discovery, Store submission, monetization, launch assets and post-launch operation. Agents receive stage-specific next actions, evidence gates and fallbacks when tools or devices are absent. Engine specialists remain separate; live requirements are verified against current Meta documentation.",
-        "version": "0.4.2",
+        "version": "0.4.3",
         "author": {
           "name": "ssheleg",
           "url": "https://x.com/sshlg93"
@@ -3681,7 +3696,7 @@
       "files": [
         {
           "path": ".claude-plugin/plugin.json",
-          "sha256": "766b9b27824b8f9c24ad690e40e2e6e6001ed8e5f731f9635a752b2ba66def53",
+          "sha256": "5ddea375283df66b668a8880fa9f8a2dd0b8501449c7142125b7406ed655713b",
           "bytes": 1200
         },
         {
@@ -3701,7 +3716,7 @@
         },
         {
           "path": "skills/quest-lifecycle/SKILL.md",
-          "sha256": "52b2128d47e933094a22c63b9e17a0fb273c39cfaf571da8f6ef206ae2a3ca6d",
+          "sha256": "4c5defbf25df5196bbae70fe26511d556845ffdc35d0b8e14f322aedc1d432f1",
           "bytes": 6283
         },
         {
@@ -3731,7 +3746,7 @@
         },
         {
           "path": "skills/quest-native/SKILL.md",
-          "sha256": "f83a678180a1aec766cb760283f024f53d5e34bd0795e8443a560bc85bab5da4",
+          "sha256": "b059d2e0cdd2dd071cb9a1d86e1c0548559358365bf18646afea3cff92a9469e",
           "bytes": 9777
         },
         {
@@ -3751,7 +3766,7 @@
         },
         {
           "path": "skills/quest-perf/SKILL.md",
-          "sha256": "93cca47df4aa28d77a6f818bd5bd67f8ee406274b66a6d36404c1eb4b7907324",
+          "sha256": "01d80cfcd2c026076d728e1d61cf198585d3a6a5a117e387ae47669273af7458",
           "bytes": 7155
         },
         {
@@ -3781,7 +3796,7 @@
         },
         {
           "path": "skills/quest-spatial/SKILL.md",
-          "sha256": "003e78099a8b438955f74d492cebf6530fdb581c791afe33cd0937f4cfa095f9",
+          "sha256": "b4adbbda3e4e51caf6b91532c69dd0c910ea3b7524a26af61d49ebad0e71f824",
           "bytes": 8890
         },
         {
@@ -3806,7 +3821,7 @@
         },
         {
           "path": "skills/quest-store/SKILL.md",
-          "sha256": "dbece3ee9ee45f252360691333026a875f0bdb4abe022969c77476910b5ce3ed",
+          "sha256": "bcc8e86d2eebdce7e3930e4c11caa0bc4d1b81b55335fc687378104c8cd0fc49",
           "bytes": 8416
         },
         {
@@ -3826,7 +3841,7 @@
         },
         {
           "path": "skills/quest-tooling/SKILL.md",
-          "sha256": "313027fb192461588c7b047d31777fa3014d01f091e59c9b0a7f54281726725f",
+          "sha256": "5b6c343a5db725e3f630a8b5393c85139ed892afec54de113f86dae50a2def4d",
           "bytes": 8677
         },
         {
@@ -3841,7 +3856,7 @@
         },
         {
           "path": "skills/quest-webxr/SKILL.md",
-          "sha256": "370b86a7c9a47bcc7d472e9535cf2c5a9a0f289ae5c2700753c0dfa25ffa7461",
+          "sha256": "3a42715f14f32009c4e50b3ccae8e6fe33c4d574fb18561b343bfd27e808457e",
           "bytes": 6526
         }
       ]
@@ -3849,15 +3864,15 @@
     {
       "name": "web3d-dev",
       "repo": "ssheleg/web3d-dev",
-      "commit": "7c04756d0124bb26b749535dc0ebb975741b19fb",
-      "version": "0.2.2",
+      "commit": "c1f45420bfcbb1f03cd37e7fb95abdac1ce89f69",
+      "version": "0.2.3",
       "pluginInstall": "web3d-dev@web3d-dev",
       "pluginPath": "plugins/web3d-dev",
       "entry": {
         "name": "web3d-dev",
         "displayName": "Web3D Dev",
         "description": "Three skills for realtime 3D on the web: the three.js WebGPU runtime with TSL, compute, post-processing and a WebGL2 fallback; the glTF asset pipeline from source to frame, with compression, budgets, sourcing and optional asset-service ordering; and a 3D animation protocol covering rigs, clip conventions, blending, GPU and instanced animation, and reduced motion. Every API fact is pinned to a verified three.js release.",
-        "version": "0.2.2",
+        "version": "0.2.3",
         "author": {
           "name": "ssheleg",
           "url": "https://x.com/sshlg93"
@@ -3891,7 +3906,7 @@
       "files": [
         {
           "path": ".claude-plugin/plugin.json",
-          "sha256": "b908de45fd41fb40cc639e0b13fcc5274fb22ee3e3fa75651c9dab3828f5a1df",
+          "sha256": "c1b85054996b3ce96b998e21c567a270a421494b4f20f9acb535f68fad94fe8d",
           "bytes": 1092
         },
         {
@@ -3911,7 +3926,7 @@
         },
         {
           "path": "skills/web3d-animation/SKILL.md",
-          "sha256": "8a95f66a049e7dc76bf798f7f28e67ff16cd85c2a3c8b03a49578669815e1549",
+          "sha256": "c9e149c1c9b9f0f5c6fd74e2a101063059e74ca8a0c26ee9a6aa3b352c709a58",
           "bytes": 10234
         },
         {
@@ -3936,7 +3951,7 @@
         },
         {
           "path": "skills/web3d-assets/SKILL.md",
-          "sha256": "50abe858fe91e0203c42da1bbf5aaa897f697479b696c4fca58a30fd4f32f7db",
+          "sha256": "9f811a6a00f50e1820d7153739dca5b7a54b3f0374025e00b078d389d0d0791d",
           "bytes": 8664
         },
         {
@@ -3956,7 +3971,7 @@
         },
         {
           "path": "skills/web3d-runtime/SKILL.md",
-          "sha256": "27103ee44ce4867be6fba80306d1daf696c9dcea9360eec89363d6100d373796",
+          "sha256": "f3b54dc2c9540d96273832f49dbeb6a34a34a2b5ac5d0186e2417fd8fbd70c53",
           "bytes": 7721
         }
       ]

package/lib/claude-pinned.js

@@ -63,6 +63,17 @@ function worktreeMain(dir) {
   const gitdir=path.resolve(dir,m[1]),at=gitdir.lastIndexOf(path.sep+'.git'+path.sep+'worktrees'+path.sep);
   return at<0?null:physical(gitdir.slice(0,at));
 }
+// The project Claude Code addresses a local scope by (measured on 2.1.299): the root of the
+// git repository the directory sits in, a linked worktree's main working tree, and the
+// directory itself outside any repository. A submodule checkout is its own root. (#267, B-251)
+function claudeAddress(dir) {
+  for(let d=dir;;) {
+    let st=null;try{st=fs.lstatSync(path.join(d,'.git'));}catch(_){}
+    if(st && st.isDirectory()) return {address:d,worktree:false};
+    if(st && st.isFile()) {const main=worktreeMain(d);return main?{address:main,worktree:true}:{address:d,worktree:false};}
+    const up=path.dirname(d);if(up===d) return {address:dir,worktree:false};d=up;
+  }
+}
 function prepare(members,inventory,opts) {
   const requested={profile:path.resolve(opts.profileRoot),home:path.resolve(opts.home)};
   const rows=Source.validate(inventory,members),profile=Bindings.profilePath(requested.profile),home=Bindings.profilePath(requested.home);
@@ -120,10 +131,11 @@ function prepare(members,inventory,opts) {
         // A linked git worktree: Claude runs a local-scope update from it against its main
         // repository's record (measured on 2.1.299, 2026-10-22), so the worktree's own
         // record is left as recorded beside a recorded main, and blocks without one.
-        const main=real===r.projectPath?worktreeMain(real):null;
+        const at=real===r.projectPath?claudeAddress(real):null;
+        const main=at && at.address!==real?at.address:null;
         if(main) {
           if(locals.some(o=>o!==r && o.projectPath===main)) {aliases.push({projectPath:r.projectPath,real:main,record:r});continue;}
-          unaddressable=r.projectPath+' is a git worktree of '+main+', which has no record';break;
+          unaddressable=r.projectPath+(at.worktree?' is a git worktree of ':' is inside the git repository ')+main+', which has no record';break;
         }
         if(real===r.projectPath && fs.statSync(real).isDirectory()) targets.push({scope:'local',projectPath:r.projectPath,record:r});
         // A path that resolves to ANOTHER record's project is that project under an

package/lib/hygiene.js

@@ -73,23 +73,72 @@ function isFlag(token) {
  */
 const HEREDOC_SHELLS = new Set(['bash', 'sh', 'zsh', 'dash', 'ksh', 'eval', 'source', '.']);
 
+/**
+ * B-253: the command substitutions in a piece of text, `$(...)` (not arithmetic `$((`) and
+ * backticks, outermost only. The shell runs these inside an unquoted-delimiter heredoc body
+ * even when the body itself is fed to a non-shell, so they are executable text.
+ */
+function substitutions(text) {
+  const out = [];
+  const t = String(text || '');
+  for (let i = 0; i < t.length; i += 1) {
+    if (t[i] === '\\') { i += 1; continue; }
+    if (t[i] === '$' && t[i + 1] === '(' && t[i + 2] !== '(') {
+      let depth = 1, j = i + 2;
+      for (; j < t.length && depth; j += 1) { if (t[j] === '(') depth += 1; else if (t[j] === ')') depth -= 1; }
+      out.push(t.slice(i + 2, depth ? j : j - 1));
+      i = j - 1;
+    } else if (t[i] === '`') {
+      const j = t.indexOf('`', i + 1);
+      out.push(t.slice(i + 1, j < 0 ? t.length : j));
+      i = j < 0 ? t.length : j;
+    }
+  }
+  return out;
+}
+
+/** Whether a quote opened on this line is still open at its end, given the state at its start. */
+function quoteAfter(line, open) {
+  let q = open;
+  for (let i = 0; i < line.length; i += 1) {
+    const c = line[i];
+    if (q === null) {
+      if (c === '\\') { i += 1; continue; }
+      if (c === '#' && (i === 0 || /\s/.test(line[i - 1]))) break;   // the rest is a comment
+      if (c === '"' || c === "'") q = c;
+    } else if (q === '"') {
+      if (c === '\\') { i += 1; continue; }
+      if (c === '"') q = null;
+    } else if (c === "'") {
+      q = null;
+    }
+  }
+  return q;
+}
+
 function executablePart(command) {
   const lines = String(command || '').split('\n');
   const out = [];
   let terminator = null;
   let dropping = false;
+  let expands = false;
+  let open = null;   // a quote still open from an earlier line (B-253)
   for (const line of lines) {
     if (terminator !== null) {
       // The terminator may be indented when the heredoc used `<<-`.
       if (line.trim() === terminator) { terminator = null; dropping = false; continue; }
-      if (dropping) continue;
+      // B-253: a non-shell's body is data, but an unquoted delimiter still runs its
+      // substitutions, so those (and only those) stay executable.
+      if (dropping) { if (expands) out.push(...substitutions(line)); continue; }
       out.push(line);
       continue;
     }
-    if (/^\s*#/.test(line)) continue;
-    const here = /<<-?\s*(['"]?)([A-Za-z_][A-Za-z0-9_]*)\1/.exec(line);
+    // A `#` line is a comment only outside a quote that an earlier line left open (B-253).
+    if (open === null && /^\s*#/.test(line)) continue;
+    const here = open === null ? /<<-?\s*(['"]?)([A-Za-z_][A-Za-z0-9_]*)\1/.exec(line) : null;
     if (here) {
       terminator = here[2];
+      expands = here[1] === '';
       // Which command is being fed? The last simple-command word before the `<<`, taken
       // after the final pipe or `&&` so `foo | python3 - <<EOF` reads as python3.
       const before = line.slice(0, here.index);
@@ -100,6 +149,7 @@ function executablePart(command) {
       out.push(before);
       continue;
     }
+    open = quoteAfter(line, open);
     out.push(line);
   }
   return out.join('\n');
@@ -617,6 +667,6 @@ function hostSelfUpdate(command) {
 
 module.exports = {
   maskedGate, hostSelfUpdate,
-  skillsCli, familyIds, bareFamilyInstall, launcherRunning, executablePart,
+  skillsCli, familyIds, bareFamilyInstall, launcherRunning, executablePart, substitutions,
   isObsidianSetup, parseConfig, reapply, bareName, REMEDY,
 };

package/lib/visibility-state.js

@@ -39,6 +39,8 @@ function validate(r) {
   if (!r || typeof r !== 'object' || Array.isArray(r)) throw new Error('visibility record is not an object');
   for (const h of HOSTS) if (r[h] !== undefined && (!Array.isArray(r[h]) || r[h].some((x) => typeof x !== 'string')))
     throw new Error(`visibility record ${h} is not a list of strings`);
+  if (r.claudeNameOnly !== undefined && (!Array.isArray(r.claudeNameOnly) || r.claudeNameOnly.some((x) => typeof x !== 'string')))
+    throw new Error('visibility record claudeNameOnly is not a list of strings');
   if (r.files !== undefined && (!r.files || typeof r.files !== 'object' || Array.isArray(r.files)
     || Object.entries(r.files).some(([h, f]) => !HOSTS.includes(h) || typeof f !== 'string' || !path.isAbsolute(f))))
     throw new Error('visibility record files is not a host-to-absolute-path map');

package/lib/visibility.js

@@ -23,8 +23,15 @@
  */
 
 const HIDE = 'user-invocable-only';
+const NAME_ONLY = 'name-only';
 const DESC_CAP = 1536;
 const DEFAULT_DAYS = 60;
+// B-254. Measured 2026-10-24: Claude Code 2.1.299 logged `Skill listing over budget:
+// 132 skills, 61725 chars > 30000 budget`. Over budget it keeps bundled skills whole and
+// gives the rest their description most-used first; the remainder are listed by name
+// only. So a quiet core skill loses its description anyway. Within the core, only what
+// was used within DEFAULT_FULL_DAYS or is named in the instructions keeps it.
+const DEFAULT_FULL_DAYS = 14;
 
 /** Skill names the instruction text references deliberately: inside backticks. */
 function namedIn(text, names) {
@@ -53,16 +60,39 @@ function core({ personal, family, usage, now, days, instructions }) {
   return set;
 }
 
-function claudePlan({ personal, core: coreSet, overrides, keep }) {
+/**
+ * The core members that keep their description: used within `fullDays`, or named in
+ * the instructions (an agent told to use a skill by name is already told when).
+ */
+function fullSet({ personal, usage, now, fullDays, instructions }) {
+  const window = (fullDays == null ? DEFAULT_FULL_DAYS : fullDays) * 86400e3;
+  const set = new Set();
+  for (const n of personal || []) {
+    const u = (usage || {})[n];
+    if (u && typeof u.lastUsedAt === 'number' && now - u.lastUsedAt <= window) set.add(n);
+  }
+  for (const n of namedIn(instructions, personal)) set.add(n);
+  return set;
+}
+
+/**
+ * `hide`: outside the core. `nameOnly`: in the core but outside `full`, so listed by name
+ * without its description. Without `full` nothing goes name-only. A key the operator set
+ * is never planned over, in either list.
+ */
+function claudePlan({ personal, core: coreSet, full, overrides, keep }) {
   const kept = new Set(keep || []);
   const hide = [];
+  const nameOnly = [];
   const respected = [];
   for (const n of personal || []) {
-    if (coreSet.has(n) || kept.has(n)) continue;
+    if (kept.has(n)) continue;
+    const inCore = coreSet.has(n);
+    if (inCore && (!full || full.has(n))) continue;
     if (overrides && Object.prototype.hasOwnProperty.call(overrides, n)) { respected.push(n); continue; }
-    hide.push(n);
+    (inCore ? nameOnly : hide).push(n);
   }
-  return { hide: hide.sort(), respected: respected.sort() };
+  return { hide: hide.sort(), nameOnly: nameOnly.sort(), respected: respected.sort() };
 }
 
 /**
@@ -77,12 +107,19 @@ function editClaudeSettings(text, { set, unset, prune }) {
   if (JSON.stringify(data, null, 2) + '\n' !== text) {
     return { ok: false, reason: 'settings.json is not in the 2-space JSON format Claude Code writes; refusing to reformat it' };
   }
+  // `set` and `unset` map a name to its value; a bare list means the hidden value, the
+  // form callers used before the name-only tier. `unset` removes a key only while it
+  // still holds the value the launcher wrote.
+  const asMap = (x) => (Array.isArray(x) ? Object.fromEntries(x.map((n) => [n, HIDE])) : (x || {}));
+  const setMap = asMap(set);
+  const unsetMap = asMap(unset);
   const ov = Object.assign({}, data.skillOverrides || {});
   let changed = false;
-  for (const n of set || []) if (ov[n] !== HIDE) { ov[n] = HIDE; changed = true; }
+  for (const [n, v] of Object.entries(setMap)) if (ov[n] !== v) { ov[n] = v; changed = true; }
   const kept = [];
-  for (const n of unset || []) {
-    if (ov[n] === HIDE) { delete ov[n]; changed = true; }
+  for (const [n, v] of Object.entries(unsetMap)) {
+    if (Object.prototype.hasOwnProperty.call(setMap, n)) continue;
+    if (ov[n] === v) { delete ov[n]; changed = true; }
     else if (n in ov) kept.push(n);
   }
   // Nothing to do leaves the file exactly as it was — including an empty map the
@@ -177,15 +214,21 @@ function editCodexConfig(text, { disable, enable }) {
   return { ok: true, text: lines.join('\n'), added };
 }
 
-/** Characters a listing spends: a listed name, plus its description while `on`. */
+/**
+ * Characters a listing spends, in the form Claude Code 2.1.299 prints it: `- name: description`
+ * while `on` (description capped at 1536), `- name` when name-only, one newline between
+ * entries; hidden costs nothing.
+ */
 function listingChars(rows) {
   let n = 0;
+  let entries = 0;
   for (const r of rows || []) {
     if (r.state === 'hidden') continue;
-    n += String(r.name).length;
-    if (r.state === 'on') n += Math.min(DESC_CAP, String(r.description || '').length);
+    entries += 1;
+    n += 2 + String(r.name).length;
+    if (r.state === 'on') n += 2 + Math.min(DESC_CAP, String(r.description || '').length);
   }
-  return n;
+  return entries ? n + entries - 1 : 0;
 }
 
 // ── Packs: the operator's marks (pack-marks.json) and per-machine overrides ──
@@ -453,7 +496,8 @@ function jsonAt(text, keys) {
 }
 
 module.exports = {
-  core, claudePlan, editClaudeSettings, editCodexConfig, listingChars, namedIn, HIDE, DEFAULT_DAYS,
+  core, fullSet, claudePlan, editClaudeSettings, editCodexConfig, listingChars, namedIn,
+  HIDE, NAME_ONLY, DEFAULT_DAYS, DEFAULT_FULL_DAYS,
   MARKS_SCHEMA, marksProblems, marksIndex, marksFromLock, packHidden, hostHide, setPackOverride,
   editJsonList, editJsonMap, jsonAt,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sshlg-skills",
-  "version": "1.76.4",
+  "version": "1.78.0",
   "skillsCli": "skills@1.7.2",
   "description": "The ssheleg harness skill layer: routing, delivery gates, specialist skills and durable handoffs for coding agents.",
   "bin": {

package/skills.json

@@ -56,13 +56,13 @@
       "pluginMarketplace": "ssheleg/super-ux",
       "pluginInstall": "super-ux@super-ux",
       "desc": "Scenario-driven UI development: a versioned design chain in docs/ux/ — the product vision, personas and jobs, user flows and the paid-acquisition funnel among them, a screens-and-states map with Figma frames, traced scenarios, evidence-backed audits, fix plans — plus docs/brand/, the verbal identity: one voice, per-surface registers, a string registry and a 41-check copy linter. /ux and /brand entry points, two doc-drift linters and a contract doctor.",
-      "version": "0.66.0",
+      "version": "0.66.1",
       "entry": "/ux",
       "role": "what the interface must do",
       "npm": "super-ux",
       "shape": "static",
       "shapeWhy": "The chain is fixed — foundation, flows, screens, scenarios — and every layer is a committed file. `/ux-audit` batches on the fly, and the batch list is printed before the run so what executed is recoverable.",
-      "commit": "13195c6402705cb656961fb04ca6d1f8c1df3fb0"
+      "commit": "4965a0b5ff10bca27e7044d957f5cdb612841783"
     },
     {
       "name": "task-pipeline",
@@ -76,13 +76,13 @@
         "evidence-docs",
         "project-audit"
       ],
-      "version": "1.101.1",
+      "version": "1.102.0",
       "entry": "/task-pipeline",
       "role": "how a change reaches the repository",
       "npm": "task-pipeline-skill",
       "shape": "static",
       "shapeWhy": "The stage list is decided before the run and stays decided, because stage 10 has to account for what ran. THREE places discover structure, and they do not land the same way: the module map and the carry-over ledger are committed artifacts, and since v1.69.0 the work graph is a third — `.task-pipeline/graph.json`, mutated mid-run by `graph.py add` and deliberately NOT committed. Every mutation records why it happened, which is what keeps a run from explaining its completion by a plan that existed only at the end; that the graph itself does not survive the run is an open row rather than a settled decision.",
-      "commit": "c914a84d1240caef00c8ed4342b0ef3eddf4f5b0"
+      "commit": "34251bff4ab67bbaed8e290884327f03ad646ad8"
     },
     {
       "name": "agent-sync",
@@ -94,13 +94,13 @@
       "skillNames": [
         "agent-sync"
       ],
-      "version": "1.23.0",
+      "version": "1.23.1",
       "entry": "/agent-sync",
       "role": "who is holding this file right now",
       "npm": "@ssheleg/agent-sync",
       "shape": "static",
       "shapeWhy": "Leases, ids and the journal are a fixed protocol; what varies is who holds what, which is state rather than shape.",
-      "commit": "5c169af9097f8192fe8786014fb08b3e8fe2204d"
+      "commit": "7c3f18aed38b4fa8d8c8d4d7da9df223141cb7ef"
     },
     {
       "name": "make-skill",
@@ -113,13 +113,13 @@
         "make-skill",
         "skill-search"
       ],
-      "version": "0.33.0",
+      "version": "0.33.1",
       "entry": "/skill-audit",
       "role": "how the skill or plugin itself is built",
       "npm": "@ssheleg/make-skill",
       "shape": "static",
       "shapeWhy": "The standard is a checklist and the audit walks it in order; a skill that passes is auditable against the same list next time.",
-      "commit": "7745e2c646c0642af8aa0796522867ba115a0f42"
+      "commit": "c59b0761cb57c8a67bb35e18615ca6f77c08b170"
     },
     {
       "name": "sheleg-design",
@@ -131,7 +131,7 @@
       "skillNames": [
         "sheleg-design"
       ],
-      "version": "1.66.2",
+      "version": "1.66.3",
       "entry": "/sheleg-design",
       "role": "how it looks and moves",
       "npm": "sheleg-design-skill",
@@ -148,7 +148,7 @@
           "note": "the catalogue, rendered from each pack's own token layer — a data surface too large for this page, kept where it is built"
         }
       ],
-      "commit": "9d8dd8b36362d38a112d726c459c31a38c2b6673"
+      "commit": "f5743d2259da679a157e9d1c01b90e8e3e1d969a"
     },
     {
       "name": "seo-aeo-audit",
@@ -184,13 +184,13 @@
         "google-auth",
         "frontend-performance"
       ],
-      "version": "0.16.0",
+      "version": "0.16.1",
       "entry": null,
       "role": "integrations: money in, tracking, errors, sign-in, speed",
       "npm": "@ssheleg/sheleg-dev",
       "shape": "static",
       "shapeWhy": "Each integration is a fixed sequence of seams; nothing decides its own next step.",
-      "commit": "5842df5677ab330738ea5ef4c14add4f7dea089d"
+      "commit": "fa5a739960973aaacabfe0fb5db8b4f5e856f232"
     },
     {
       "name": "agent-stack",
@@ -249,7 +249,7 @@
         "quest-store",
         "quest-webxr"
       ],
-      "version": "0.4.2",
+      "version": "0.4.3",
       "entry": null,
       "role": "how a Quest product moves from platform choice to launch and operation",
       "npm": "@ssheleg/xr-dev",
@@ -262,7 +262,7 @@
           "note": "Stage map, engine paths and immersive design acceptance, with separate evidence for build, device, Store and operation."
         }
       ],
-      "commit": "98e26301a664232cd27c6ad9737bb74547dd4e1a"
+      "commit": "ba885bb48d2737902628c3a9e4d512379feb65c6"
     },
     {
       "name": "web3d-dev",
@@ -276,13 +276,13 @@
         "web3d-assets",
         "web3d-animation"
       ],
-      "version": "0.2.2",
+      "version": "0.2.3",
       "entry": null,
       "role": "how realtime 3D on the web runs, ships its assets and moves",
       "npm": "@ssheleg/web3d-dev",
       "shape": "static",
       "shapeWhy": "Three fixed questions with fixed seams — runtime, assets, motion — and one shared contract, the clip canon, duplicated into both skills that need it and checked identical.",
-      "commit": "7c04756d0124bb26b749535dc0ebb975741b19fb"
+      "commit": "c1f45420bfcbb1f03cd37e7fb95abdac1ce89f69"
     }
   ],
   "agents": [