tillerhand 3.48.1 → 3.49.1

package/docs/architecture/overview.md

@@ -10,7 +10,7 @@
                           │
                           ├──> [Auth provider]
                           ├──> [Payment]
-                          └──> [E-posta / AI API / Depolama]
+                          └──> [Email / AI API / Storage]
 ```
 
 ## 2. Technology choice

package/docs/decisions/log.md

@@ -1,7 +1,7 @@
 # Decisions
 
 > There are two sections:
-> 1. **Decision log:** one line for every decision asked. Door: `one-way` (costly to reverse) / `two-way` (easy to reverse). Decided by: `user` or `automatic` (when question mode is off). Logs from before 3.48 say `tek` / `çift` and `kullanıcı` / `otomatik`; both are read.
+> 1. **Decision log:** one line for every decision asked. Door: `one-way` (costly to reverse) / `two-way` (easy to reverse). Decided by: `user` or `automatic` (when question mode is off).
 > 2. **ADRs** (Architecture Decision Record): decisions that affect the architecture or the long term, and all one-way decisions, go in a separate file: `docs/decisions/adr-NNNN-kisa-ad.md` (template: `adr-template.md`).
 >
 > Look here before asking a decision: if it was made before, do not ask again, follow it.

package/docs/legal/privacy-kvkk.md

@@ -1,54 +1,54 @@
-# Yasal / KVKK / Gizlilik
+# Legal / KVKK / Privacy
 
-> Bu bir kontrol listesidir, hukuki danışmanlık değildir. Kişisel veri işleyen veya ödeme alan
-> bir ürünü yayına almadan önce metinleri bir hukukçuya kontrol ettir.
-> Türkiye'de kullanıcıya hizmet veriyorsan KVKK (6698), yurt dışından kullanıcı varsa GDPR de gündeme gelir.
+> This is a checklist, not legal advice. Before you launch a product that processes personal data or takes payments,
+> have a lawyer check the texts.
+> If you serve users in Turkey, KVKK (6698) applies; if you have users from abroad, GDPR may apply too.
 
-## 1. Veri envanteri (önce bunu çıkar)
+## 1. Data inventory (do this first)
 
-| Veri | Neden toplanıyor (amaç) | Hukuki dayanak | Nerede saklanıyor (ülke) | Ne kadar süre | Kimlerle paylaşılıyor |
+| Data | Why it is collected (purpose) | Legal basis | Where it is stored (country) | How long | Who it is shared with |
 |---|---|---|---|---|---|
-| E-posta | Hesap, bildirim | Sözleşmenin ifası | [Servis, bölge] | Hesap silinene kadar | [E-posta servisi] |
-| IP, cihaz bilgisi | Güvenlik, hata takibi | Meşru menfaat | | | [Sentry vb.] |
+| Email | Account, notification | Performance of a contract | [Service, region] | Until the account is deleted | [Email service] |
+| IP, device information | Security, error tracking | Legitimate interest | | | [Sentry etc.] |
 | [...] | | | | | |
 
-Kural: **Amaç yoksa toplama.** Kullanmadığın veriyi isteme.
+Rule: **No purpose, no collection.** Do not ask for data you do not use.
 
-## 2. Yayında olması gereken metinler
+## 2. Texts that must be live
 
-- [ ] **Aydınlatma metni (KVKK md. 10):** Veri sorumlusu, amaçlar, aktarılan taraflar, toplama yöntemi, haklar.
-- [ ] **Gizlilik politikası:** Aydınlatma metniyle birleşik olabilir. Kayıt formunda ve footer'da link.
-- [ ] **Çerez politikası + çerez onay bandı:** Zorunlu olmayan (analitik, pazarlama) çerezler **onaydan önce yüklenmez**. Reddet butonu, kabul et kadar görünür olmalı.
-- [ ] **Kullanım şartları / üyelik sözleşmesi.**
-- [ ] **Açık rıza metni:** Sadece açık rıza gereken işlemler için (pazarlama, yurt dışına aktarımın bazı halleri, özel nitelikli veri). Aydınlatma metniyle aynı onay kutusunda birleştirme.
-- [ ] Ücretli ürün ise: **Mesafeli satış sözleşmesi** ve **ön bilgilendirme formu** (6502 sayılı Kanun), iade/cayma koşulları.
+- [ ] **Privacy notice (KVKK art. 10):** Data controller, purposes, parties it is transferred to, collection method, rights.
+- [ ] **Privacy policy:** Can be combined with the privacy notice. Link in the sign-up form and in the footer.
+- [ ] **Cookie policy + cookie consent banner:** Non-essential (analytics, marketing) cookies are **not loaded before consent**. The reject button must be as visible as the accept button.
+- [ ] **Terms of use / membership agreement.**
+- [ ] **Explicit consent text:** Only for processing that needs explicit consent (marketing, some cases of transfer abroad, special categories of data). Do not merge it into the same checkbox as the privacy notice.
+- [ ] For a paid product: **Distance sales contract** and **pre-information form** (Law no. 6502), return/withdrawal terms.
 
-## 3. Kullanıcı hakları süreçleri
+## 3. User rights processes
 
-- [ ] Kullanıcı verisini görebiliyor / indirebiliyor (veya talep edebiliyor).
-- [ ] **Hesap silme** uygulama içinden yapılabiliyor ve gerçekten siliyor/anonimleştiriyor (yedeklerdeki durum metinde belirtildi).
-- [ ] Başvuru kanalı (e-posta adresi) metinde yazılı; başvurular **en geç 30 gün** içinde yanıtlanıyor.
+- [ ] The user can see / download their data (or request it).
+- [ ] **Account deletion** can be done inside the app and really deletes/anonymizes (the status in backups is stated in the text).
+- [ ] The application channel (email address) is written in the text; applications are answered **within 30 days at most**.
 
-## 4. Yurt dışına veri aktarımı
+## 4. Transfer of data abroad
 
-Vercel, Supabase, AWS, OpenAI, Sentry gibi yurt dışı sunuculu servisler = yurt dışına aktarım.
+Services with servers abroad, such as Vercel, Supabase, AWS, OpenAI, Sentry = transfer abroad.
 
-- [ ] Hangi servislerin hangi bölgede veri tuttuğu veri envanterinde yazılı.
-- [ ] Mümkünse AB bölgesi seçildi.
-- [ ] KVKK md. 9 kapsamında aktarım dayanağı belirlendi (2024 değişikliği sonrası: standart sözleşme imzalanıyorsa Kurul'a süresi içinde bildirim gerekir). **Hukukçuya danış.**
+- [ ] Which services keep data in which region is written in the data inventory.
+- [ ] The EU region was chosen where possible.
+- [ ] The transfer basis under KVKK art. 9 was determined (after the 2024 amendment: if a standard contract is signed, notification to the Personal Data Protection Authority (KVKK Authority) is required within the deadline). **Ask a lawyer.**
 
-## 5. Diğer yükümlülükler
+## 5. Other obligations
 
-- [ ] **VERBİS** kayıt yükümlülüğü kontrol edildi (çalışan sayısı / bilanço eşiklerine göre muafiyet olabilir).
-- [ ] Ticari e-posta/SMS gönderiliyorsa: önceden onay, **İYS** (İleti Yönetim Sistemi) kaydı, her iletide ret linki.
-- [ ] Veri ihlali olursa: Kurul'a **72 saat** içinde bildirim prosedürü `docs/operations/maintenance.md` → olay müdahalede yazılı.
-- [ ] Çocuklara yönelik değilse yaş sınırı kullanım şartlarında belirtildi.
-- [ ] Kullanılan font, ikon, görsel ve kütüphanelerin lisansları ticari kullanıma uygun.
+- [ ] The **VERBİS** registration obligation was checked (an exemption may apply based on the number of employees / balance sheet thresholds).
+- [ ] If commercial email/SMS is sent: prior consent, **İYS** (Message Management System) registration, an opt-out link in every message.
+- [ ] In case of a data breach: the procedure for notifying the Personal Data Protection Board (KVKK Board) within **72 hours** is written in `docs/operations/maintenance.md` → incident response.
+- [ ] If the product is not aimed at children, the age limit is stated in the terms of use.
+- [ ] The licenses of the fonts, icons, images and libraries used allow commercial use.
 
-## 6. Mobil mağaza ek gereksinimleri
+## 6. Extra requirements for mobile stores
 
-`docs/architecture/stack.md` (mobil) → "Go live (extra)" bölümüne bak: App Store gizlilik etiketleri, Google Play Veri Güvenliği formu, uygulama içi hesap silme.
+See `docs/architecture/stack.md` (mobile) → the "Go live (extra)" section: App Store privacy labels, Google Play Data Safety form, in-app account deletion.
 
-## 7. Gözden geçirme
+## 7. Review
 
-Her **3 ayda bir** ve yeni bir veri türü / yeni bir servis eklendiğinde bu dosyayı ve yayındaki metinleri güncelle.
+Update this file and the live texts every **3 months** and whenever a new data type / a new service is added.

package/docs/operations/deploy-setup.md

@@ -30,7 +30,7 @@ Checked: 2026-10-25. Sources: [Environment variables](https://vercel.com/docs/en
 
 **Environment variables.** Settings → Environment Variables. For each variable pick the environment: Production, Preview, Development. Keys and tokens are entered as **Secret** (unreadable after saving); open values such as URLs as **Config**. A change does not apply to old deploys; a new deploy is needed. Limit: 64 KB total per deploy (5 KB per variable at the edge).
 
-**Domain.** Settings → Domains → Add Domain (CLI: `vercel domains add example.com <proje>`). When you add the apex, `www` is recommended: add both and redirect one to the other.
+**Domain.** Settings → Domains → Add Domain (CLI: `vercel domains add example.com <project>`). When you add the apex, `www` is recommended: add both and redirect one to the other.
 - Apex (`example.com`): **A** record. Take the value from the project's domain card. In most projects it is `76.76.21.21`; new projects may differ (e.g. `216.198.79.1`); verification looks for the value on the card.
 - Subdomain (`www`, `app`): **CNAME**, the target is project-specific (on the card, e.g. `…vercel-dns-017.com`).
 - If the domain is in another Vercel account, a **TXT** verification named `_vercel` is requested.

package/docs/operations/feature-flags.md

@@ -21,7 +21,7 @@ The `/dashboard` dashboard reads this table. Date format `YYYY-MM-DD`, status `o
 
 ## Rules
 
-- The flag name uses the `ozellik_adi` form and matches `docs/product/glossary.md`.
+- The flag name uses the `feature_name` form and matches `docs/product/glossary.md`.
 - The code path is also tested while the flag is off (at least one test for each of the two states).
 - After the feature is open to everyone and has run without problems for 2 weeks, the flag and the old code path are removed.
 - Kill switch: the step to turn it off from the panel or an environment variable is written in this file and has been tried at least once.

package/docs/product/glossary.md

@@ -17,11 +17,11 @@ The states a record can have and the transitions between them. This stops the AI
 ```
 [invoice.status]: draft → sent → paid
                                   ↘ overdue → paid
-                  taslak → iptal (cancelled)
+                  draft → cancelled
 ```
 
 ## Writing rules
 
 - Code: English (`camelCase` variable, `PascalCase` component/type, `snake_case` DB field).
-- UI text: Turkish; formal or informal "you" ("siz" or "sen")? → [pick: sen]
-- Date: `GG.AA.YYYY`, money: `1.234,56 ₺` (`tr-TR` with `Intl`).
+- UI text: [language]; formal or informal "you", if the language has both → [pick]
+- Date and money: format with `Intl` and the UI locale (e.g. `tr-TR`: `29.10.2026`, `1.234,56 ₺`) → [locale]

package/docs/product/launch.md

@@ -14,7 +14,7 @@
 |---|---|---|
 | `signup` | Signup completed | Acquisition |
 | `activated` | [First moment of value: e.g. sent their first invoice] | Activation |
-| `[ana_eylem]` | [The product's main action] | Usage |
+| `[main_action]` | [The product's main action] | Usage |
 | `upgrade` | Moved to a paid plan | Revenue |
 
 - [ ] Feedback channel: an in-app form or email, in an easy-to-see place.

package/docs/product/prd.md

@@ -14,7 +14,7 @@
 | [Primary] | | | |
 | [Secondary] | | | |
 
-## 3. Value proposition (value proposition)
+## 3. Value proposition
 
 [One sentence: "With [product], [user] gets [result], because [difference]."]
 
@@ -40,7 +40,7 @@ The dashboard reads the "Priority" label; keep its wording.
 ### AC-02: [Feature name]
 ...
 
-## 6. Out of scope (out of scope: NOT built in this release)
+## 6. Out of scope (NOT built in this release)
 
 This list stops the AI from widening the scope. Write every "later" idea that comes to mind here.
 

package/docs/product/roadmap.md

@@ -3,7 +3,7 @@
 > Each task must be small enough to **finish in one session** (about 1-3 hours, 1-5 files).
 > Split a task that looks big. Always give the AI a single task.
 > Format: `- [ ] G-NNN: [what] — done when: [how do I know it is done?]`
-> The dashboard reads the "## Phase N" headings; keep that form (roadmaps from before 3.48 say "## Faz N", and those are read too).
+> The dashboard reads the "## Phase N" headings; keep that form.
 
 ## Phase 0 — Setup (skeleton)
 

package/docs/product/specs/_template.md

@@ -4,7 +4,7 @@
 > The "behavior that must not change" lines start with an acceptance criterion id (`- AC-01.1: ...`). The gate (`gate.mjs --run`) goes red if these ids have no test or if they are red in the last test report.
 > The gate reads only the test report written in its own run; if the test command writes no JUnit report, it only checks that the test exists.
 > If you change behavior on purpose or change a criterion id, update this file first; if the spec is no longer valid, move it to `docs/archive/`.
-> The dashboard reads the labels, values and the "Behavior that must not change" heading below; keep their wording. Specs written before 3.48 use Turkish ones (Tür, Sınıf, Kural, özellik/hata); they are still read.
+> The dashboard reads the labels, values and the "Behavior that must not change" heading below; keep their wording.
 
 **Type:** [feature / bug]
 **Class:** [bug only: empty-input / validation / authorization / date-time / locale / sorting / concurrency / configuration / external-service / contract / ui-state / other]

package/docs/product/unit-economics.md

@@ -4,7 +4,7 @@
 > can pass the price without anyone noticing. `/dashboard` does the calculation from the inputs below **automatically**.
 > Filled in at `/start` Step 5; `/maintain monthly` updates it with real bills.
 > Use a dot as the decimal separator in numbers (e.g. `3.5`). Use a single currency.
-> The dashboard reads the input labels below; keep their wording (files from before 3.48 have Turkish labels, and those are still read).
+> The dashboard reads the input labels below; keep their wording.
 
 ## Inputs
 

package/docs/quality/test-plan.md

@@ -3,7 +3,7 @@
 > Approach: **Balanced.** Automatic tests are required for critical flows; a manual checklist is enough for the rest.
 > Test tools and commands: `docs/architecture/stack.md`.
 
-## 1. Critical flows (critical flows; automatic test REQUIRED)
+## 1. Critical flows (automatic test REQUIRED)
 
 Every change that touches one of these flows comes with a test. If a test is red, there is no merge/deploy.
 
@@ -48,7 +48,7 @@ About half of AI code has a security hole (Veracode, 2025). So for every endpoin
 | Log injection | A line break (`
 `) and a fake log line in the input | Escaped / single line in the logs |
 
-Test names start with the prefix `ATTACK:` (tests written before 3.48 may use `SALDIRI:`; both count). The `security-auditor` agent counts missing adversarial tests as KRİTİK.
+Test names start with the prefix `ATTACK:`. The `security-auditor` agent counts missing adversarial tests as CRITICAL.
 
 **If Supabase is used,** the adversarial test of the database layer comes ready: `tests/security/rls.mjs`. An anonymous user and a second user try to read, update, delete and write on behalf of the first user's rows; it is red if there is a public table with RLS off or not registered in the test. It runs only against local Supabase (CI `rls` job, no secret needed). Every new table is added to the `TABLES` list. Tests at the application layer (server action, route handler) are still written separately according to the table above.
 
@@ -72,7 +72,7 @@ Test names start with the prefix `ATTACK:` (tests written before 3.48 may use `S
 ## 4. Commands
 
 ```bash
-[test komutu]          # all
-[test komutu] [dosya]  # single file
-[e2e komutu]           # end to end
+[test command]         # all
+[test command] [file]  # single file
+[e2e command]          # end to end
 ```

package/docs/workflow/decision-protocol.md

@@ -17,7 +17,6 @@ Every choice that affects one of the following is a **decision point** and is as
 | `security` | Authorization model, roles, session length, rate limits, personal data handling |
 | `cost` | Choice of paid service, plan tier, AI model choice, spending limits |
 
-Projects set up before 3.48 may use the old Turkish codes (`urun`, `teknik`, `tasarim`, `icerik`, `veri`, `guvenlik`, `maliyet`); they mean the same topic. Write the English code; in a log that already uses the Turkish codes, keep using them.
 
 **Not a decision point** (not asked; apply it and report it briefly in the status block): file/variable/function names (follow `docs/product/glossary.md`), the internal layout of code, formatting, repeating a pattern the project has already decided.
 
@@ -55,7 +54,7 @@ Classify every decision before asking and state it in the question text:
 
 ## 4. Question mode
 
-The state is kept in the `**Question mode:**` line of `docs/workflow/progress.md` (before 3.48 `**Soru modu:**`). Default: `on · closed topics: none`.
+The state is kept in the `**Question mode:**` line of `docs/workflow/progress.md`. Default: `on · closed topics: none`.
 
 | What the user says | What you do |
 |---|---|

package/docs/workflow/mcp-catalog.md

@@ -21,7 +21,7 @@ These servers do not come in `.mcp.json`; the command that needs one asks the us
 | Playwright MCP | Exploratory browser testing, long interactive flow | `claude mcp add --scope local playwright -- npx -y @playwright/mcp@0.0.83` | For screenshots, `node .claude/hooks/preview.mjs`. For interactive trials, use the Playwright CLI first (every command is asked; in the project folder it reads the config file in the repo): `npx -y @playwright/cli@0.1.22 open <url>`, `snapshot`, `console`, `requests`, `screenshot`. The CLI does not force page data into the context, so it spends fewer tokens |
 | Chrome DevTools MCP | `/findings-perf`, `/findings-ux` | `claude mcp add --scope local chrome-devtools -- npx -y chrome-devtools-mcp@1.10.1` | Performance trace (LCP, CLS, INP), network waterfall, console |
 | Figma | `/design` (if the design is in Figma) | `claude mcp add --scope local --transport http figma-remote-mcp https://mcp.figma.com/mcp` | OAuth (`/mcp`). Figma's official plugin (~17 skills) is not used because of the context budget |
-| rea (CLI, not MCP) | `/research` (how a competitor feature works), `/adopt` (a part with no source) | No setup: `npx -y rea-agents@6.2.0 <alt komut>`; subcommands: `npx -y rea-agents@6.2.0 --help`. Needs Node `^22.19` or `>=24.11` | Only software the user owns or is authorized to inspect. The license agreement (EULA) may forbid reverse engineering; commercial tools (IDA, Hopper, JEB) follow their own license. `setup` is not run (it changes agent settings). The analysis is local; inspecting a site sends real requests to that site |
+| rea (CLI, not MCP) | `/research` (how a competitor feature works), `/adopt` (a part with no source) | No setup: `npx -y rea-agents@6.2.0 <subcommand>`; subcommands: `npx -y rea-agents@6.2.0 --help`. Needs Node `^22.19` or `>=24.11` | Only software the user owns or is authorized to inspect. The license agreement (EULA) may forbid reverse engineering; commercial tools (IDA, Hopper, JEB) follow their own license. `setup` is not run (it changes agent settings). The analysis is local; inspecting a site sends real requests to that site |
 | Supabase dev (write) | `/build` (trying things in dev) | `claude mcp add --scope local --transport http supabase-dev "https://mcp.supabase.com/mcp?project_ref=DEV_REF&features=database,docs"` | Only the **development** project or branch (`DEV_REF`). The prod ref is never written to this definition. Schema changes are still made with a migration file |
 
 ## Opened when a service is chosen

package/docs/workflow/skills.md

@@ -51,7 +51,7 @@
 
 ## Context packages
 
-The skill descriptions of every plugin that is on are loaded into the context in each session. The skill list is limited to 1% of the context; when it overflows, the descriptions of rarely used skills drop and Claude does not recognize them. Skills inside a plugin cannot be switched off one by one. So plugins are split into **core** and **packages**. Packages come switched off in `.claude/settings.json`; in its first step the related command checks with `node .claude/hooks/tools.mjs --required <paket>` and, if the package is off, asks to switch it on together with its cost. Switching on affects only this machine (`.claude/settings.local.json`). Management: `/tools`. Definitions: `.claude/hooks/tools.mjs` → `PACKAGES`.
+The skill descriptions of every plugin that is on are loaded into the context in each session. The skill list is limited to 1% of the context; when it overflows, the descriptions of rarely used skills drop and Claude does not recognize them. Skills inside a plugin cannot be switched off one by one. So plugins are split into **core** and **packages**. Packages come switched off in `.claude/settings.json`; in its first step the related command checks with `node .claude/hooks/tools.mjs --required <package>` and, if the package is off, asks to switch it on together with its cost. Switching on affects only this machine (`.claude/settings.local.json`). Management: `/tools`. Definitions: `.claude/hooks/tools.mjs` → `PACKAGES`.
 
 | Package | Plugins | Command that switches it on |
 |---|---|---|
@@ -150,7 +150,7 @@ First the style direction is chosen (`/design`). Each direction maps to a skill;
 | PR description | `mattpocock-skills:pr` |
 | Edit CLAUDE.md, a command or a skill (`/retro`) | `mattpocock-skills:writing-for-agents` |
 | CLAUDE.md audit, session lessons (`/retro`, `/wrap-up`) | `claude-md-management`: `claude-md-improver`, `/revise-claude-md` |
-| "Don't do this again" → permanent rule | `/hookify <kural>` (`.claude/hookify.*.local.md`) |
+| "Don't do this again" → permanent rule | `/hookify <rule>` (`.claude/hookify.*.local.md`) |
 | React/Next performance (web) · React Native (mobile) | `react-best-practices`, `composition-patterns` · `react-native-guidelines` (Vercel) |
 | Database schema, query, index | `postgres-best-practices:*`, `supabase:*` |
 | Token and cost detail | `/session-report` (HTML), `node .claude/hooks/cost.mjs` for the dashboard |

package/docs/workflow/usage-limits.md

@@ -18,7 +18,7 @@
 | 🟡 yellow | 60–84% | 70–89% | Before work starts, state the estimated cost. In board meetings, halve the member count. |
 | 🔴 red | ≥ 85% | ≥ 90% | Before new work starts, state the estimated cost and the remaining share in one line, then continue. Offer the options in §3 only if the user asks. |
 
-The thresholds are in `.claude/hooks/usage.mjs` → `ESIKLER`; if you change them, change both together.
+The thresholds are in `.claude/hooks/usage.mjs` → `THRESHOLDS`; if you change them, change both together.
 
 ## 3. When planning work
 

package/kit/CHANGELOG.md

@@ -3,6 +3,40 @@
 The kit version is in `kit/VERSION`. To update a project, run `/kit-update` in it.
 Items with an "Adapt by hand" note concern files owned by the project; the update does not touch them.
 
+## [3.49.1] - 2026-10-29
+
+### Fixed
+- **The gate command approval names keys that will not run.** A key under `## Commands` the gate does not read (for example `tip kontrol:` instead of `type check:`) is listed in the approval dialog and in the gate's "command approval needed" text, so a skipped check is visible before you approve.
+- The dashboard's copy button keeps a path in the command (`/fix-bug login fails on /api/login`, `/fix-bug blank page in /index.html`); only a second slash command (`then /clear`) cuts it.
+
+## [3.49.0] - 2026-10-29
+
+### Changed
+- **Everything the kit ships is English.** Hooks, commands, agents, board files, templates, the eval fixtures and the Turkey add-on (`docs/legal/turkiye.md`, the KVKK checklist) are written in English; official names (KVKK, GİB, e-Fatura, iyzico, PayTR) stay as they are. The conversation language is still chosen in the first question of `/start` and `/adopt`.
+- **Turkish interface texts ship as a translation file.** Hook messages, the status line and the dashboard read Turkish from `.claude/i18n/tr.json`; other languages are still translated by `/language`. A missing key falls back to English.
+- **A set-up project with no language chosen talks in English.**
+- **Labels and keys stay English in every language.** The session note tells the AI to keep `**Active phase:**`, `## Where we left off`, `type check:` and the verdict words English, because the tools read them.
+- Skill descriptions no longer carry Turkish trigger words.
+- Renamed: the checkpoint tag prefix is `checkpoint/` (was `calisan/`), the path marker is `kit:path-allowed` (was `kit:yol-izinli`), the AI add-on variables are `AI_MODEL_DEFAULT`, `AI_MODEL_FAST`, `AI_USER_DAILY_LIMIT`, the Dependabot group is `minor-updates`, the preview folder of an unnamed task is `.previews/latest`, and `/adopt` archives the old files as `claude-md-old.md` / `agents-md-old.md`.
+- The dashboard warns when a board meeting result has no verdict it knows, and the gate warns about unknown keys under `## Commands`.
+
+### Breaking
+- Turkish labels, values, verdicts, ids (`Ö-01.1`, `O_01_1`), prefixes (`SALDIRI:`) and arguments (`/tools ac`, `hepsi`, `K/O/B`…) are no longer read. A project file that still uses them looks empty to the dashboard and the status line, and a meeting with a Turkish verdict shows as unknown.
+- The gate asks for the command approval once more after the update.
+- The update no longer migrates from older versions: the narrator style rename, the old dashboard flag, the old preferences file name and the old package names are not rewritten.
+- `/rollback` lists only `checkpoint/*` tags.
+
+### Compatibility
+- Adapt by hand: move Turkish labels in `docs/workflow/progress.md`, `AGENTS.md` (`## Commands`), the decision log and board files to English; take the kit's template as `.kit-new` and copy your content over. Rename the AI variables in your `.env`, and replace `kit:yol-izinli` markers with `kit:path-allowed`.
+
+### Fixed
+- The eval set-up wrote Turkish labels into the test project, so the kit condition read nothing from it.
+- **The gate is no longer green on Semgrep alone.** With lint, type check and test all missing (no `## Commands` block, or a heading in another language), a clean Semgrep scan made the gate green and opened the commit gate. Now the result is EMPTY unless a project check passed.
+- The unknown-key warning under `## Commands` reads only the code block: a note line or an address no longer counts as a key.
+- A translation whose text drops or adds a placeholder (`{list}`, `{path}`) is not shown; the English text is shown instead, so an approval dialog never hides what it asks. Translation files are read once per process.
+- The Turkey add-on names the Personal Data Protection Board and the Personal Data Protection Authority separately (who issues decisions, who is notified), and the e-invoice source keeps the communiqué's short name (VUK No. 509).
+- `/start` says that writing a translation file asks for approval once.
+
 ## [3.48.1] - 2026-10-29
 
 ### Changed

package/kit/VERSION

@@ -1 +1 @@
-3.48.1
+3.49.1