switchroom 0.21.10 → 0.21.12

package/dist/cli/switchroom.js

@@ -2120,7 +2120,7 @@ var init_esm = __esm(() => {
 });
 
 // src/build-info.ts
-var VERSION = "0.21.10", COMMIT_SHA = "fd1650e7", COMMIT_DATE = "2026-08-14T03:50:00Z";
+var VERSION = "0.21.12", COMMIT_SHA = "66041822", COMMIT_DATE = "2026-08-14T20:57:00Z";
 
 // src/cli/resolve-version.ts
 import { existsSync, readFileSync } from "node:fs";
@@ -84729,6 +84729,45 @@ var init_server4 = __esm(() => {
 var ROUTE_FIELD_SHIP_TS = 1785456000;
 
 // src/fleet-health/detect.ts
+function emptyGwHits() {
+  const out = {};
+  for (const name of GATEWAY_SIGNAL_NAMES)
+    out[name] = 0;
+  return out;
+}
+function orphanedDbAlarmLanes(alarmLine) {
+  const names = [];
+  for (const m of alarmLine.matchAll(ORPHANED_DB_ALARM_TARGET_RE)) {
+    const target = m[1];
+    names.push(target.slice(target.lastIndexOf("/") + 1));
+  }
+  if (names.length === 0)
+    return null;
+  const declared = ORPHANED_DB_ALARM_COUNT_RE.exec(alarmLine)?.[1];
+  if (declared === undefined || names.length !== Number(declared))
+    return null;
+  return names;
+}
+function classifyOrphanedDbTick(lines, alarmIdx) {
+  const lanes = orphanedDbAlarmLanes(lines[alarmIdx] ?? "");
+  if (lanes === null || !lanes.every((n) => n.startsWith("history.db"))) {
+    return "unrecovered";
+  }
+  let verdict = null;
+  for (let j = alarmIdx + 1;j < lines.length; j++) {
+    const line = lines[j];
+    if (!line || !ORPHANED_DB_SWEEP_LINE_RE.test(line))
+      continue;
+    if (GATEWAY_SIGNATURES["orphaned-db-handle"].test(line))
+      break;
+    if (ORPHANED_DB_LANE_VETO_RE.test(line))
+      return "unrecovered";
+    verdict ??= ORPHANED_DB_RECOVERED_RE.test(line) ? "recovered" : "unrecovered";
+    if (verdict === "unrecovered")
+      return "unrecovered";
+  }
+  return verdict ?? "unrecovered";
+}
 function parseTurns(text) {
   const out = [];
   for (const raw of text.split(`
@@ -84832,27 +84871,39 @@ function detectTurnFindings(agent, turns, opts = {}) {
 }
 function detectGatewayFindings(agent, logText, logName = `logs/${agent}/gateway-supervisor.log`) {
   const findings = [];
-  const gw_hits = {
-    "duplicate-delivery-represent": 0,
-    "represent-escalation": 0,
-    "reply-delivery-failure": 0,
-    "orphaned-db-handle": 0
-  };
+  const gw_hits = emptyGwHits();
   const lines = logText.split(`
 `);
+  const eventIndex = new Map;
   for (const [name, re] of Object.entries(GATEWAY_SIGNATURES)) {
     for (let i2 = 0;i2 < lines.length; i2++) {
       const line = lines[i2];
       if (!line)
         continue;
       if (re.test(line)) {
-        gw_hits[name] += 1;
+        const signal = name === "orphaned-db-handle" && classifyOrphanedDbTick(lines, i2) === "recovered" ? "orphaned-db-handle-recovered" : name;
+        gw_hits[signal] += 1;
+        const origin = extractTurnId(line);
+        const pointer = `${logName}:${i2 + 1}`;
+        const ts = extractTs(line);
+        if (origin !== null) {
+          const eventKey = `${signal}|${origin}`;
+          const at = eventIndex.get(eventKey);
+          if (at !== undefined) {
+            const prev = findings[at];
+            if (ts !== null || prev.ts === null) {
+              findings[at] = { ...prev, log_pointer: pointer, ts };
+            }
+            continue;
+          }
+          eventIndex.set(eventKey, findings.length);
+        }
         findings.push({
-          signal: name,
+          signal,
           agent,
-          turn_id: extractTurnId(line) ?? `${agent}:gw#${i2 + 1}`,
-          log_pointer: `${logName}:${i2 + 1}`,
-          ts: extractTs(line)
+          turn_id: origin ?? `${agent}:gw#${i2 + 1}`,
+          log_pointer: pointer,
+          ts
         });
       }
     }
@@ -84891,14 +84942,27 @@ function scanAgent(agent, turnsText, gatewayText, opts = {}) {
     escalate
   };
 }
-var HANG_MS = 360000, HANG_MAXTOOLS = 2, SILENT_NOOP_FLOOR_TS = 1783900800, GATEWAY_SIGNATURES, ISO_TS_RE;
+var HANG_MS = 360000, HANG_MAXTOOLS = 2, SILENT_NOOP_FLOOR_TS = 1783900800, GATEWAY_SIGNATURES, GATEWAY_SIGNAL_MEMBERS, GATEWAY_SIGNAL_NAMES, ORPHANED_DB_RECOVERED_RE, ORPHANED_DB_SWEEP_LINE_RE, ORPHANED_DB_ALARM_TARGET_RE, ORPHANED_DB_ALARM_COUNT_RE, ORPHANED_DB_LANE_VETO_RE, ISO_TS_RE;
 var init_detect = __esm(() => {
   GATEWAY_SIGNATURES = {
     "duplicate-delivery-represent": /represent duplicate-send/,
-    "represent-escalation": /obligation escalation/,
+    "represent-escalation": /obligation escalation (?:delivered \+ closed|PERMANENTLY undeliverable)/,
     "reply-delivery-failure": /tg-post method=sendRichMessage[^\n]*status=err(?![a-z])/,
     "orphaned-db-handle": /orphaned-db-sweep DETECTED \d+ deleted-inode DB handle/
   };
+  GATEWAY_SIGNAL_MEMBERS = {
+    "duplicate-delivery-represent": true,
+    "represent-escalation": true,
+    "reply-delivery-failure": true,
+    "orphaned-db-handle": true,
+    "orphaned-db-handle-recovered": true
+  };
+  GATEWAY_SIGNAL_NAMES = Object.keys(GATEWAY_SIGNAL_MEMBERS);
+  ORPHANED_DB_RECOVERED_RE = /orphaned-db-sweep reopened history\.db \u2014 writes are durable again/;
+  ORPHANED_DB_SWEEP_LINE_RE = /orphaned-db-sweep /;
+  ORPHANED_DB_ALARM_TARGET_RE = /\bfd=\d+ (\S+)/g;
+  ORPHANED_DB_ALARM_COUNT_RE = /DETECTED (\d+) deleted-inode DB handle/;
+  ORPHANED_DB_LANE_VETO_RE = /orphaned-db-sweep found (?:an orphaned registry\.db handle|orphaned handle\(s\) on )/;
   ISO_TS_RE = /\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(Z|[+-]\d{2}:?\d{2})?/;
 });
 
@@ -84906,6 +84970,12 @@ var init_detect = __esm(() => {
 function mapSignal(signal) {
   return SIGNAL_MAP[signal];
 }
+function countingUnitFor(signal) {
+  return GATEWAY_SIGNAL_SET.has(signal) ? "gateway-event" : "log-line";
+}
+function siblingDedupKeys(key) {
+  return SIBLING_DEDUP_KEYS.get(key) ?? [];
+}
 function dedupKeyFor(finding) {
   const m = mapSignal(finding.signal);
   return `${m.job_spec}:${m.signature}`;
@@ -84935,8 +85005,9 @@ function reachFactor(reachCount) {
 function issuePriority(severity, frequency, reachCount, newestIso, now2 = new Date, windowDays = 30) {
   return severity * frequencyFactor(frequency) * reachFactor(reachCount) * recencyFactor(newestIso, now2, windowDays);
 }
-var SIGNAL_MAP, ALL_JOB_SPECS;
+var SIGNAL_MAP, ALL_JOB_SPECS, GATEWAY_SIGNAL_SET, LEGACY_COUNTING_UNIT = "log-line", RECLASSIFICATION_GROUPS, SIBLING_DEDUP_KEYS;
 var init_mapping = __esm(() => {
+  init_detect();
   SIGNAL_MAP = {
     "silent-no-op-candidate": {
       failure_mode: "silent-no-op",
@@ -84968,6 +85039,12 @@ var init_mapping = __esm(() => {
       job_spec: "survive-reboots-and-real-life",
       signature: "orphaned-db-handle:deleted-inode-writes"
     },
+    "orphaned-db-handle-recovered": {
+      failure_mode: "drift",
+      severity: 1,
+      job_spec: "survive-reboots-and-real-life",
+      signature: "orphaned-db-handle:recovered-in-tick"
+    },
     "hang-long-stalled": {
       failure_mode: "partial",
       severity: 2,
@@ -85048,6 +85125,23 @@ var init_mapping = __esm(() => {
     "talk-to-agents-from-anywhere",
     "track-plan-quota-live"
   ];
+  GATEWAY_SIGNAL_SET = new Set(GATEWAY_SIGNAL_NAMES);
+  RECLASSIFICATION_GROUPS = [
+    ["orphaned-db-handle", "orphaned-db-handle-recovered"],
+    ["silent-no-op-candidate", "flush-recovered-turn"]
+  ];
+  SIBLING_DEDUP_KEYS = (() => {
+    const m = new Map;
+    for (const group of RECLASSIFICATION_GROUPS) {
+      const keys = group.map((s) => {
+        const map2 = mapSignal(s);
+        return `${map2.job_spec}:${map2.signature}`;
+      });
+      for (const key of keys)
+        m.set(key, keys.filter((k) => k !== key));
+    }
+    return m;
+  })();
 });
 
 // src/fleet-health/ledger.ts
@@ -85063,7 +85157,8 @@ function indexPriorIssues(prior) {
         status: iss.status,
         job_spec: rec.job_spec,
         failure_mode: iss.failure_mode,
-        severity: iss.severity
+        severity: iss.severity,
+        counting_unit: iss.counting_unit ?? LEGACY_COUNTING_UNIT
       });
     }
   }
@@ -85109,7 +85204,8 @@ function buildLedger(findings, opts = {}) {
         occurrences: [],
         reach: new Set,
         newest: null,
-        count: 0
+        count: 0,
+        counting_unit: countingUnitFor(f.signal)
       };
       aggs.set(key, agg);
     }
@@ -85128,12 +85224,16 @@ function buildLedger(findings, opts = {}) {
   for (const agg of aggs.values()) {
     const count = agg.count;
     const prior = priorIdx.get(agg.dedup_key);
+    const unitChanged = prior !== undefined && prior.counting_unit !== agg.counting_unit;
     let status = "open";
-    if (count <= RESOLVED_THRESHOLD && prior && prior.frequency > RESOLVED_THRESHOLD) {
-      status = "resolved-pending-verify";
+    if (unitChanged) {
+      status = count <= RESOLVED_THRESHOLD && prior.status === "resolved-pending-verify" ? "resolved-pending-verify" : "open";
     } else if (prior?.status === "resolved-pending-verify" && count <= RESOLVED_THRESHOLD) {
       status = "closed";
+    } else if (prior && count <= RESOLVED_THRESHOLD && count < prior.frequency) {
+      status = "resolved-pending-verify";
     }
+    const reopened = prior?.status === "closed" && status !== "closed";
     const issue2 = {
       dedup_key: agg.dedup_key,
       failure_mode: agg.failure_mode,
@@ -85143,7 +85243,9 @@ function buildLedger(findings, opts = {}) {
       recency: agg.newest,
       occurrences: agg.occurrences,
       ...prior?.gh_issue !== undefined ? { gh_issue: prior.gh_issue } : {},
-      status
+      status,
+      ...reopened ? { reopened: true } : {},
+      counting_unit: agg.counting_unit
     };
     const list2 = byJob.get(agg.job_spec) ?? [];
     list2.push(issue2);
@@ -85155,6 +85257,7 @@ function buildLedger(findings, opts = {}) {
     if (prior.status !== "open" && prior.status !== "resolved-pending-verify") {
       continue;
     }
+    const migratedTo = siblingDedupKeys(dedup_key).filter((k) => aggs.has(k));
     const issue2 = {
       dedup_key,
       failure_mode: prior.failure_mode,
@@ -85164,7 +85267,10 @@ function buildLedger(findings, opts = {}) {
       recency: null,
       occurrences: [],
       ...prior.gh_issue !== undefined ? { gh_issue: prior.gh_issue } : {},
-      status: "closed"
+      status: "closed",
+      close_reason: migratedTo.length > 0 ? "reclassified" : "count-drop",
+      ...migratedTo.length > 0 ? { reclassified_into: migratedTo.sort() } : {},
+      counting_unit: prior.counting_unit
     };
     const list2 = byJob.get(prior.job_spec) ?? [];
     list2.push(issue2);
@@ -129717,19 +129823,29 @@ function syncIssue(deps, repo, job_spec, iss) {
   if (!upd.ok) {
     deps.log(`fleet-health: gh issue edit #${num3} failed: ${upd.stderr}`);
   }
-  if (iss.status === "closed") {
-    const c = deps.run([
+  if (iss.reopened) {
+    const r = deps.run([
       "issue",
-      "close",
+      "reopen",
       num3,
       "-R",
       repo,
       "--comment",
-      `Verified count-drop (frequency ${iss.frequency} \u2264 resolved threshold). Closed by the Fleet Health sensor.`
+      `Reopened by the Fleet Health sensor: this defect is back (frequency ${iss.frequency}` + ` in the current scan window). The earlier close was not a durable fix.`
     ]);
-    if (c.ok)
-      deps.log(`fleet-health: closed GH #${num3} (count-drop) for ${iss.dedup_key}`);
+    if (r.ok)
+      deps.log(`fleet-health: reopened GH #${num3} for ${iss.dedup_key}`);
     else
+      deps.log(`fleet-health: gh issue reopen #${num3} failed: ${r.stderr}`);
+    return;
+  }
+  if (iss.status === "closed") {
+    const reclassified = iss.close_reason === "reclassified";
+    const comment = reclassified ? `No occurrences in the current scan window because these findings were` + ` RECLASSIFIED into ${(iss.reclassified_into ?? []).join(", ")} \u2014 the same` + ` detected condition re-sorted by its outcome. This is NOT a verified fix;` + ` the evidence now lives on the sibling issue. Closed by the Fleet Health sensor.` : `Verified count-drop (frequency ${iss.frequency} \u2264 resolved threshold).` + ` Closed by the Fleet Health sensor.`;
+    const c = deps.run(["issue", "close", num3, "-R", repo, "--comment", comment]);
+    if (c.ok) {
+      deps.log(`fleet-health: closed GH #${num3} (${reclassified ? "reclassified" : "count-drop"})` + ` for ${iss.dedup_key}`);
+    } else
       deps.log(`fleet-health: gh issue close #${num3} failed: ${c.stderr}`);
   }
 }

package/dist/host-control/main.js

@@ -21565,7 +21565,7 @@ function allocateAgentUid(name) {
 }
 
 // src/build-info.ts
-var VERSION = "0.21.10";
+var VERSION = "0.21.12";
 
 // src/setup/hindsight-recall-passthrough.ts
 var HINDSIGHT_RECALL_TAG_WEIGHT_SEED = Object.freeze({ sidechain: 0.8 });

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "switchroom",
   "//version": "NOT the release version — source of truth is the git tag, resolved by scripts/build.mjs:resolveVersion() (see CLAUDE.md > Standard release process). This field is stale by design and only the Layer-4 dev/non-tag fallback for build.mjs + src/cli/resolve-version.ts; do NOT bump it expecting a release to pick it up. npm-pack tarball naming needs a real version — do that as an UNCOMMITTED pack-time bump (see release step 6), never a committed one.",
-  "version": "0.21.10",
+  "version": "0.21.12",
   "description": "Run Claude Code 24/7 on your Claude Pro/Max subscription over Telegram. Open-source alternative to OpenClaw and NanoClaw — no API keys.",
   "type": "module",
   "bin": {
@@ -28,9 +28,10 @@
     "test:vitest": "vitest run",
     "test:bun": "bun test telegram-plugin/tests/hermes-messages-paging.test.ts telegram-plugin/tests/hermes-session-search.test.ts telegram-plugin/tests/agent-state-dir-preload.test.ts telegram-plugin/tests/hindsight-bank-preload.test.ts telegram-plugin/tests/catch-all-forwarded-history.test.ts src/vault/grants.test.ts src/vault/grants-db.test.ts src/vault/write-grants.test.ts src/vault/broker/server-grants.test.ts src/vault/broker/server-write-grants.test.ts src/vault/broker/server-scope-persist.test.ts src/vault/broker/server-tokenless-scope.test.ts src/vault/broker/server-mint-grant-passphrase-attest.test.ts src/vault/broker/server-passphrase-attest.test.ts src/vault/broker/server-mint-grant-posture-attest.test.ts src/vault/broker/server-admin-only-keys.test.ts src/vault/broker/client-token.test.ts src/vault/broker/server-unlock.test.ts src/vault/broker/auto-unlock.test.ts src/vault/broker/drift-detection.test.ts tests/vault-broker-passphrase.test.ts src/cli/vault-get-broker.test.ts src/vault/resolver-via-broker.test.ts src/vault/broker/scope.test.ts src/vault/broker/server.test.ts src/litellm/provision-apply-e2e.test.ts src/drive/disconnect.test.ts src/drive/grants.test.ts src/drive/oauth.test.ts src/drive/onboarding.test.ts src/drive/reconciler.test.ts src/drive/vault-slots.test.ts src/drive/wrapper.test.ts src/vault/approvals/kernel.test.ts src/vault/approvals/approval-origin.test.ts src/vault/approvals/self-approval-bypass.test.ts src/vault/approvals/schema-idempotent.test.ts src/vault/broker/server-approvals.test.ts telegram-plugin/tests/boot-probes.test.ts telegram-plugin/tests/boot-version-string.test.ts telegram-plugin/tests/history.test.ts telegram-plugin/tests/boot-briefing-builder.test.ts telegram-plugin/tests/cross-turn-card-gate.test.ts telegram-plugin/tests/emission-authority-open-gate.test.ts telegram-plugin/tests/emission-authority-ping-gate.test.ts telegram-plugin/tests/emission-authority-card-drain-gate.test.ts telegram-plugin/tests/per-topic-current-turn.test.ts telegram-plugin/tests/history-reaper.test.ts telegram-plugin/tests/ipc-server-client.test.ts telegram-plugin/tests/ipc-server-race.test.ts telegram-plugin/tests/ipc-server-buzz-dedup.test.ts telegram-plugin/tests/ipc-server-query-pending-permission.test.ts telegram-plugin/tests/ipc-server-check-pre-approved.test.ts telegram-plugin/tests/rollout-narration-edit-socket.test.ts telegram-plugin/tests/gateway-bridge.test.ts telegram-plugin/tests/gateway-startup-mutex.test.ts telegram-plugin/tests/gateway-clean-shutdown-marker.test.ts telegram-plugin/tests/boot-card-dedupe.test.ts telegram-plugin/tests/boot-card-reason.test.ts telegram-plugin/tests/progress-update.test.ts telegram-plugin/tests/progress-fallback-cap.test.ts telegram-plugin/tests/progress-cap.test.ts telegram-plugin/tests/quota-cache.test.ts telegram-plugin/tests/silent-reply-guard.test.ts telegram-plugin/tests/unhandled-rejection-policy.test.ts telegram-plugin/tests/registry-turns.test.ts telegram-plugin/registry/subagents.test.ts telegram-plugin/registry/subagents-bugs.test.ts telegram-plugin/tests/subagent-watcher-parent-turn-key.test.ts telegram-plugin/tests/worker-origin-gap-dispatch.test.ts telegram-plugin/tests/subagent-nested-dispatch.test.ts telegram-plugin/tests/nested-worker-visibility-harness.test.ts telegram-plugin/tests/turns-writer.test.ts telegram-plugin/tests/resume-inbound-builder.test.ts telegram-plugin/tests/subagent-tracker-hooks.test.ts telegram-plugin/tests/resolve-calling-subagent.test.ts telegram-plugin/tests/gateway-update-placeholder-dispatch.test.ts telegram-plugin/tests/status-query-telemetry.test.ts telegram-plugin/tests/reaction-trigger.test.ts telegram-plugin/tests/reaction-trigger-flow.test.ts telegram-plugin/tests/subagent-watcher-workflow-visibility.test.ts telegram-plugin/uat/load-env.test.ts telegram-plugin/uat/feed-matcher.test.ts telegram-plugin/uat/uat-driver.test.ts telegram-plugin/gateway/webhook-ingest-server.test.ts telegram-plugin/tests/skill-proposal-card.test.ts",
     "test:watch": "vitest",
-    "lint": "tsc --noEmit && node scripts/check-plugin-references.mjs && bash scripts/check-bot-api-wrapping.sh && node scripts/check-bun-test-imports.mjs && node scripts/check-test-runner-coverage.mjs && node scripts/check-bun-module-mock-scope.mjs && node scripts/check-no-pii-secrets.mjs && node scripts/check-bench-baseline-anonymised.mjs && node scripts/check-vault-test-hermeticity.mjs && node scripts/check-auth-test-hermeticity.mjs && node scripts/check-agent-state-dir-hermeticity.mjs && node scripts/check-hindsight-bank-hermeticity.mjs && node scripts/check-parked-turn-start-hermeticity.mjs && node scripts/check-no-broadcast-delivery.mjs && node scripts/check-stale-tool-descriptions.mjs && node scripts/check-mcp-instructions-budget.mjs && node scripts/check-web-subscription-honest.mjs && node scripts/check-no-unpinned-npx-playwright.mjs && node scripts/check-gateway-line-ratchet.mjs && node scripts/check-retry-flood-hooks.mjs && node scripts/check-callback-ctx-wrapping.mjs && node scripts/check-ctx-send-wrapping.mjs && node scripts/check-status-pin-single-path.mjs && node scripts/check-litellm-config-guard.mjs && node scripts/check-release-asset-names.mjs && node scripts/check-foreign-db-readonly.mjs && node scripts/check-claude-cli-lockstep.mjs && node scripts/check-changelog-entry.mjs && node scripts/check-agent-attribution-trailers.mjs && node scripts/check-hindsight-write-redaction.mjs && bun scripts/check-secret-pattern-parity.ts && bun scripts/check-hostd-template-guard.ts",
+    "lint": "tsc --noEmit && node scripts/check-plugin-references.mjs && bash scripts/check-bot-api-wrapping.sh && node scripts/check-bun-test-imports.mjs && node scripts/check-test-runner-coverage.mjs && node scripts/check-bun-module-mock-scope.mjs && node scripts/check-no-pii-secrets.mjs && node scripts/check-bench-baseline-anonymised.mjs && node scripts/check-vault-test-hermeticity.mjs && node scripts/check-auth-test-hermeticity.mjs && node scripts/check-agent-state-dir-hermeticity.mjs && node scripts/check-hindsight-bank-hermeticity.mjs && node scripts/check-parked-turn-start-hermeticity.mjs && node scripts/check-no-broadcast-delivery.mjs && node scripts/check-stale-tool-descriptions.mjs && node scripts/check-mcp-instructions-budget.mjs && node scripts/check-web-subscription-honest.mjs && node scripts/check-no-unpinned-npx-playwright.mjs && node scripts/check-gateway-line-ratchet.mjs && node scripts/check-retry-flood-hooks.mjs && node scripts/check-callback-ctx-wrapping.mjs && node scripts/check-ctx-send-wrapping.mjs && node scripts/check-status-pin-single-path.mjs && node scripts/check-litellm-config-guard.mjs && node scripts/check-release-asset-names.mjs && node scripts/check-foreign-db-readonly.mjs && node scripts/check-claude-cli-lockstep.mjs && node scripts/check-changelog-entry.mjs && node scripts/check-agent-attribution-trailers.mjs && node scripts/check-hindsight-write-redaction.mjs && node scripts/check-mutation-coverage.mjs && bun scripts/check-secret-pattern-parity.ts && bun scripts/check-hostd-template-guard.ts",
     "lint:tsc": "tsc --noEmit",
     "lint:hindsight-write-redaction": "node scripts/check-hindsight-write-redaction.mjs",
+    "lint:mutation-coverage": "node scripts/check-mutation-coverage.mjs --all",
     "lint:secret-pattern-parity": "bun scripts/check-secret-pattern-parity.ts",
     "lint:plugin-references": "node scripts/check-plugin-references.mjs",
     "lint:bot-api-wrapping": "bash scripts/check-bot-api-wrapping.sh",
@@ -56,6 +57,7 @@
     "lint:claude-cli-lockstep": "node scripts/check-claude-cli-lockstep.mjs",
     "lint:changelog-entry": "node scripts/check-changelog-entry.mjs",
     "changelog:generate": "node scripts/gen-changelog-entry.mjs",
+    "changelog:cut": "node scripts/cut-changelog-release.mjs",
     "lint:agent-attribution-trailers": "node scripts/check-agent-attribution-trailers.mjs",
     "lint:hostd-template-guard": "bun scripts/check-hostd-template-guard.ts",
     "lint:bench-baseline-anonymised": "node scripts/check-bench-baseline-anonymised.mjs",
@@ -82,6 +84,7 @@
     "@types/bun": "^1.3.11",
     "@types/node": "^22.0.0",
     "@vitest/coverage-v8": "3.2.4",
+    "commonmark": "0.31.2",
     "typescript": "^5.7.0",
     "vitest": "^3.2.4"
   },

package/skills/dev-protocol/SKILL.md

@@ -139,17 +139,21 @@ is not a rebuttal.
   `AWAITING_CHECKS` means a required workflow is not listening for
   `merge_group`; `.github/MERGE-QUEUE.md` owns that failure mode and the
   invariants that prevent it.
-- **Stage the CHANGELOG entry author-side, before `gh pr create`.** A PR that
-  changes shippable code must add a `## Unreleased` entry (#4469's
+- **Stage the changelog note author-side, before `gh pr create`.** A PR that
+  changes shippable code must add a NEW `changelog.d/` fragment file (#4469's
   `check-changelog-entry.mjs`, part of `npm run lint`, enforces it). Don't
-  hand-write it: run `bun run changelog:generate` in the repo — it derives the
-  entry from your conventional-commit title, appends it under `## Unreleased`
-  (idempotently — a second run is a no-op), and respects the escape hatches. Then
-  commit CHANGELOG.md so it lands in your own push. It runs AUTHOR-side, not in
-  CI, because a CI commit-back with the default `GITHUB_TOKEN` cannot re-trigger
-  the required checks and would wedge the PR (`.github/MERGE-QUEUE.md` §
-  "Author-side changelog generation"). Opt a docs/chore/test PR out with the
-  `no-changelog` label or a `[skip changelog]` token on its own line.
+  hand-edit `CHANGELOG.md`: run `bun run changelog:generate` in the repo — it
+  derives a per-PR fragment (`changelog.d/<pr>-<slug>.<type>.md`) from your
+  conventional-commit title (idempotently — a second run is a no-op) and
+  respects the escape hatches. Then commit the fragment so it lands in your
+  own push. Fragment files are per-PR, so they never conflict with another
+  in-flight PR — editing the shared `## Unreleased` section does, which is
+  exactly the conflict class fragments replace (see `changelog.d/README.md`).
+  It runs AUTHOR-side, not in CI, because a CI commit-back with the default
+  `GITHUB_TOKEN` cannot re-trigger the required checks and would wedge the PR
+  (`.github/MERGE-QUEUE.md` § "Author-side changelog generation"). Opt a
+  docs/chore/test PR out with the `no-changelog` label or a `[skip changelog]`
+  token on its own line.
 - **A test that wouldn't fail on the bug it guards is not a test.** Assert the
   observable outcome, not that the code path executed.
 - **Prefer a deterministic mechanism over prompt discipline.** If a check, a

package/skills/switchroom-release/SKILL.md

@@ -22,14 +22,20 @@ Cut a release of `switchroom/switchroom` and get it live on the fleet. This is a
 1. `git fetch origin`, confirm `main` is at the commit you want released.
 2. `gh pr list --state open` — confirm no PR meant for this release is still open. Ask the operator if unsure.
 3. Confirm CI on `main` is green (`gh run list --branch main --limit 3`).
-4. Read `CHANGELOG.md` — the `## Unreleased` section is the **continuously-maintained** staging area for this release's notes. Every PR since the last release stages its own entry there as it merges, enforced by `scripts/check-changelog-entry.mjs` (part of `npm run lint`), so by release time this section should already read as a near-complete draft — you tidy and summarise, you do NOT author it from scratch. **An empty (or missing) `## Unreleased` at release time is now an ANOMALY, not the normal state:** it means either there genuinely is nothing to release, OR the enforcement was bypassed (`no-changelog` labels / `[skip changelog]` tokens on their own line on PRs that should have staged entries). Before assuming the former, cross-check against `git log <last-tag>..origin/main` — if real shippable work landed but Unreleased is bare, investigate and reconstruct rather than shipping a hollow release (this is exactly the v0.20.12 failure mode the enforcement exists to prevent).
+4. Read the staged notes — they live in TWO places, both **continuously maintained** as PRs merge and both enforced by `scripts/check-changelog-entry.mjs` (part of `npm run lint`): the `changelog.d/` **fragment files** (the primary path — every shippable PR adds its own `<pr>-<slug>.<type>.md`; see `changelog.d/README.md`) and any legacy/hand-staged entries under `## Unreleased` in `CHANGELOG.md`. Together they should already read as a near-complete draft — you assemble and tidy, you do NOT author from scratch. **Nothing staged at release time (no fragments AND an empty `## Unreleased`) is an ANOMALY, not the normal state** — `bun run changelog:cut` refuses to cut it: it means either there genuinely is nothing to release, OR the enforcement was bypassed (`no-changelog` labels / `[skip changelog]` tokens on their own line on PRs that should have staged notes). Before assuming the former, cross-check against `git log <last-tag>..origin/main` — if real shippable work landed but nothing is staged, investigate and reconstruct rather than shipping a hollow release (this is exactly the v0.20.12 failure mode the enforcement exists to prevent).
 5. Pick the next version: read the latest tag (`git tag --list 'v*' --sort=-v:refname | head -1`) and bump the patch (or minor if the operator asks). Confirm with the operator which.
 
-## Step 1 — Consolidate the changelog (the release commit is CHANGELOG-only)
+## Step 1 — Assemble the changelog (the release commit is CHANGELOG + fragment deletions only)
 
-- The section is maintained continuously (see pre-flight 4), so this step is now a **rename + tidy**, not authorship: change the `## Unreleased` header to `## vX.Y.Z — <one-line summary>`, then read through the staged entries and lightly edit for grouping/summary. If Unreleased was empty or thin, STOP and resolve the anomaly (pre-flight 4) before proceeding — do not invent a release note.
-- **Re-seed a fresh empty `## Unreleased` block at the top** (header + the convention HTML comment) immediately below `# Changelog`, so the staging area exists for the next cycle and `scripts/check-changelog-entry.mjs` keeps enforcing it. (Copy the comment block from the section you just renamed.)
-- The release commit touches **CHANGELOG.md only**. Do NOT bump `package.json` (placeholder discipline).
+- The notes are staged continuously (see pre-flight 4), so this step is **one command + a review**, not authorship:
+
+  ```bash
+  bun run changelog:cut -- --version vX.Y.Z --summary "<one-line summary>"
+  ```
+
+  `scripts/cut-changelog-release.mjs` folds every `changelog.d/` fragment (plus anything hand-staged under `## Unreleased`) into a new `## vX.Y.Z — <summary>` section grouped by category, **re-seeds a fresh empty `## Unreleased` block** (header + convention comment) below `# Changelog`, and **deletes the consumed fragment files**. Use `--dry-run` first to preview the assembled section. It FAILS LOUDLY on a double cut or an empty cut — if it refuses for "nothing to release", STOP and resolve the anomaly (pre-flight 4); do not invent a release note.
+- Read through the assembled section and lightly edit for grouping/summary before committing.
+- The release commit touches **CHANGELOG.md and the deleted `changelog.d/` fragments only**. Do NOT bump `package.json` (placeholder discipline). (A CHANGELOG + fragment-deletion PR changes no shippable code, so `check-changelog-entry.mjs` passes it without a staged note of its own — deleting fragments never counts as staging one.)
 - Branch protection blocks direct push to `main`, so: create a `release/vX.Y.Z` branch, push it, open a `chore: release vX.Y.Z` PR (base `main`), arm auto-merge (squash, delete-branch) on green CI.
 
 ## Step 2 — Create the DRAFT release on a PINNED SHA, then push the tag