Changelog

v3.57.4 — 2026-04-22

Web Platform

• Fix: Command Center + KB-path resume now scope by connected repo. Disconnecting a repo hides its conversations; reconnecting the same URL restores them.
• New: conversations.repo_url column (migration 029) stamped at INSERT, filtered on every SELECT.
• New: Cross-tab disconnect/reconnect awareness — hook refetches when another tab swaps users.repo_url.
• New: Disconnected empty-state hint pointing users to reconnect the prior repository.
• Agent-native: conversations_lookup tool documents repo-scope semantics.

web-v0.48.7 — 2026-04-22

Web Platform

• Fix: Command Center + KB-path resume now scope by connected repo. Disconnecting a repo hides its conversations; reconnecting the same URL restores them.
• New: conversations.repo_url column (migration 029) stamped at INSERT, filtered on every SELECT.
• New: Cross-tab disconnect/reconnect awareness — hook refetches when another tab swaps users.repo_url.
• New: Disconnected empty-state hint pointing users to reconnect the prior repository.
• Agent-native: conversations_lookup tool documents repo-scope semantics.

web-v0.48.6 — 2026-04-22

• [bot-fix] fix(billing): guard subscription handlers against out-of-order events

web-v0.48.5 — 2026-04-22

Web Platform

• Fix (config): Set NEXT_PUBLIC_APP_URL in Doppler prd (https://app.soleur.ai) and dev (http://localhost:3000). External config change; no code behavior change.
• Docs: Symbol-anchored comment above the reportSilentFallback guard in apps/web-platform/server/agent-runner.ts documenting Doppler soleur/prd as the expected source, the coincidental fallback match, and the five consumers (buildKbShareTools, checkout/route.ts, billing/portal/route.ts, validate-origin.ts, notifications.ts).

web-v0.48.4 — 2026-04-22

• [bot-fix] fix(chat): move activeStreams into useReducer to remove ref mutation inside setState

v3.57.3 — 2026-04-21

• chore(agents-md): raise rule-count warn threshold from 100 to 115 (compound step 8 + cq-agents-md-why-single-line).
• chore(agents-md): migrate 3 hook/skill-enforced rules to their enforcement sites using pointer-preservation; establishes precedent post-lint-rule-ids.py.
• chore(scripts): add lint-agents-compound-sync.sh pre-commit guard (AGENTS.md ↔ compound SKILL.md threshold sync).
• docs: update feat-agents-rule-threshold spec (relax FR4, mark FR5 satisfied).
• docs: new learning — 2026-04-21-agents-md-rule-retirement-deprecation-pattern.md.

v3.57.2 — 2026-04-21

Content

• Service-automation launch content (blog + 5-channel distribution + HN Show cut).
• Inbound link from why-most-agentic-tools-plateau pillar to the new post.

Plugin

• plugins/soleur/agents/marketing/fact-checker.md — Sharp Edges extended: consult knowledge-base/project/learnings/ before flagging framework claims; explicit cross-file-consistency warning.
• plugins/soleur/skills/gemini-imagegen/SKILL.md — Phase 0 pre-flight now targets gemini-3-pro-image-preview (the documented default) and asserts image bytes in the response, not just a 2xx. Documents the current free-tier limit: 0 state.

Knowledge

• New learning: 2026-04-21-fact-checker-file-scope-plus-eleventy-footnote-gap.md.

v3.57.1 — 2026-04-21

• feat(content): auto-generate article 2026-04-21

v3.57.0 — 2026-04-21

Plugin

• Added peer-plugin-audit sub-mode in plugins/soleur/skills/competitive-analysis/ with a new reference file (references/peer-plugin-audit.md) encoding input validation, inventory enumeration, stratified depth sampling, Soleur catalog mapping, semantic Task delegation, CPO founder-outcome gate, and CMO ICP-expansion framing.
• Changed competitive-analysis SKILL.md description and routing to support both tier-scan (default) and peer-plugin-audit sub-modes.
• Changed agent-native-audit and growth SKILL.md descriptions (trimmed for token budget).

Artifacts (commits of record)

• knowledge-base/project/brainstorms/2026-04-21-claude-skills-audit-brainstorm.md — 2026-04-21 brainstorm with CPO/CMO/CTO assessments, 10 key decisions.
• knowledge-base/project/specs/feat-claude-skills-audit/spec.md — FR1-FR8, TR1-TR7 (this PR implements FR1, TR1, TR2, TR3, TR6, TR7).
• knowledge-base/project/plans/2026-04-21-feat-peer-plugin-audit-sub-mode-plan.md — plan revised per DHH + Kieran + Simplicity reviewers.
• knowledge-base/project/learnings/2026-04-21-peer-plugin-audit-brainstorm-patterns.md — session learning: premise-challenge + productize-checkpoint patterns.
• knowledge-base/project/learnings/2026-04-21-skill-description-budget-at-cap-requires-plan-time-surgery.md — implementation learning: zero-headroom budget requires plan-time surgery with exact text.

v3.56.2 — 2026-04-21

Web Platform (infra)

• Allowlist documented AI crawler UAs (GPTBot, OAI-SearchBot, ChatGPT-User, ClaudeBot, anthropic-ai, claude-web, PerplexityBot, Perplexity-User, CCBot, Google-Extended, GoogleOther, Applebot-Extended, Amazonbot, Bytespider, Meta-ExternalAgent, Meta-ExternalFetcher, cohere-ai, Diffbot, DuckAssistBot, YouBot) at the Cloudflare edge so AEO investments (FAQPage schema, self-contained FAQs, citation-ready answers) become visible to AI answer engines. Prior state: every listed UA received HTTP 403 on soleur.ai/*.
• Broaden the cf_api_token_rulesets Doppler secret's documented scope from Cache Rules:Edit only to Cache Rules:Edit + Zone WAF:Edit, reflecting the alias's new second consumer.

Plugin

• terraform-architect agent: three new Sharp Edges bullets — narrow-token plan-vs-apply scope asymmetry, variable-description drift on alias reuse, UA substring-collision avoidance. Do-not-add-managed-WAF-skip warning.

v3.56.1 — 2026-04-21

Marketing site (plugins/soleur/docs/)

• Homepage (index.njk): add "Company-as-a-Service" eyebrow above H1, rewrite first H2 to thread the category term, rewrite "Is Soleur free?" FAQ (and its FAQPage JSON-LD mirror) to drop the Spark-tier reference and link to /pricing/.
• Base layout (_includes/base.njk): add founder (Jean Deruelle) and foundingDate: 2026 to the homepage Organization JSON-LD; rename SoftwareApplication offer "Spark (Cloud Platform)" → "Solo (Cloud Platform)" to match live pricing.
• Pricing (pricing.njk): replace the $95K/mo footnote with three linked citations — Robert Half 2026 Salary Guide, Payscale US database (queried 2026-04-21), and Levels.fyi total-comp methodology. BLS dropped: 403s to curl under Akamai bot-fight, breaking the pre-merge URL gate.
• Vision (vision.njk): rewrite three card titles for search intent (Multi-Model AI Agent Orchestration, Centralized Decision Memory and Approval Dashboard, Cross-Department Agent Coordination); poetic names preserved in descriptions.
• CaaS pillar promotion (#2658): create new top-level /company-as-a-service/ page, delete blog/what-is-company-as-a-service.md, wire 301 via pageRedirects.js. Sweep 9 existing blog posts + brand-guide + content-strategy to link directly to the new pillar (avoids routing internal link equity through the meta-refresh stub).

Knowledge base

• Count-drift reconciliation (#2659 P0): soft-floor "60+ agents / 60+ skills" across brand-guide.md, content-strategy.md, marketing-strategy.md, components/agents.md, components/skills.md, project/README.md, and legal docs (GDPR, cookie policy). Root README.md stays exact (owned by sync-readme-counts.sh). Live site renders exact counts dynamically via {{ stats.agents }}.
• Brand guide: meta paragraph explaining the soft-floor convention.

Drift-guard test suite (new)

plugins/soleur/test/marketing-content-drift.test.ts pins the post-state across all seven fixes (5 tests, all GREEN):

1. Prose uses soft floors, not stale exact counts (sweeps KB marketing, components, project README, legal docs; allowlist for archival tree).
2. Site copy contains no "Spark" tier references.
3. Homepage Organization JSON-LD has @id, founder, foundingDate.
4. /company-as-a-service/ exists with H1 + /blog/what-is-company-as-a-service/ has meta-refresh + forward canonical.
5. /pricing/ footnote has ≥2 external citations + a YYYY-MM-DD date.

Workflow

• Captured learning at knowledge-base/project/learnings/best-practices/2026-04-21-eleventy-site-url-concatenation-broken-without-leading-slash.md.
• Routed to plugins/soleur/skills/work/SKILL.md Follow-Existing-Patterns: grep rendered _site/ for host-letter concatenation artifacts after any template port.

v3.56.0 — 2026-04-21

Plugin

• deepen-plan skill: added Quality Check item for verifying strict-mode operator behavior on test scenarios that claim "bad input is caught by <operator>".

Operations

• New GHA watchdog workflow: scheduled-cloud-task-heartbeat.yml (daily 09:30 UTC).
• New ops runbook: knowledge-base/engineering/ops/runbooks/cloud-scheduled-tasks.md.
• New label: cloud-task-silence (B60205 / red, description: "Scheduled Cloud/GHA task has not fired within its threshold").
• Learning: knowledge-base/project/learnings/2026-04-21-cloud-task-silence-watchdog-pattern.md.

v3.55.4 — 2026-04-21

CI

• Added .github/actions/anthropic-preflight composite action (1-token probe + cap-exhausted + transient-5xx soft-skip + sk-* log redaction).
• Changed 15 workflows to prepend a preflight job scoped to permissions: contents: read that gates the existing Claude step.
• Added scripts/wire-anthropic-preflight.awk and scripts/add-preflight-perms.awk so the wiring pattern is reproducible for future edits.

Learnings

• Added knowledge-base/project/learnings/integration-issues/2026-04-21-workflow-dispatch-requires-default-branch.md — gh workflow run --ref <feature-branch> 404s on files not on main, and planning a temporary workflow_dispatch test workflow for pre-merge verification is infeasible.
• Routed the learning into plugins/soleur/skills/plan/SKILL.md Sharp Edges so future plans flag the pattern.

v3.55.3 — 2026-04-21

• fix(seo): weekly SEO/AEO audit fixes 2026-04-21

v3.55.2 — 2026-04-21

Plugin

• soleur:brainstorm Phase 1.0 External Platform Verification: added dimension (6) for tool-replacement evaluations — requires a programmatic surface check (MCP/CLI/API) before treating a candidate as a replacement for an existing headless integration. Prevents false-premise migration plans (e.g., GUI-only Claude Design replacing MCP-based Pencil).

Knowledge Base

• New brainstorm capturing the Pencil-vs-Claude-Design evaluation with decision, rationale, and re-evaluation triggers.
• New learning documenting the headless-MCP-first rubric for third-party tool replacements.

v3.55.1 — 2026-04-21

• feat(content): auto-generate article 2026-04-21

web-v0.48.3 — 2026-04-21

Web Platform Infra

• New cloudflare_bot_management.soleur_ai (bot-management.tf): ai_bots_protection = "disabled", fight_mode = false, enable_js = true.
• bot-allowlist.tf hardening: uablock→uaBlock, matches→contains, explicit logging { enabled = true }, http_request_firewall_managed re-added to skipped phases.
• New variable cf_api_token_bot_management + cloudflare.bot_management provider alias.

AGENTS.md

• New: cq-cloudflare-ruleset-requires-applied-verification, cq-cloudflare-ruleset-skip-action-requires-logging-block, cq-cloudflare-block-ai-bots-not-skippable, cq-provider-binary-grep-before-dashboard-reflex.
• Tightened: wg-when-a-feature-creates-external — black-box functional probe is shipping gate for traffic-affecting infra.

Knowledge Base

• New learning: 2026-04-21-cloudflare-block-ai-bots-feature-bypasses-waf-phase-pipeline.md — full incident narrative for the 4 failure modes and the out-of-phase-pipeline root cause.

web-v0.48.2 — 2026-04-21

Web Platform (infra)

• Allowlist documented AI crawler UAs (GPTBot, OAI-SearchBot, ChatGPT-User, ClaudeBot, anthropic-ai, claude-web, PerplexityBot, Perplexity-User, CCBot, Google-Extended, GoogleOther, Applebot-Extended, Amazonbot, Bytespider, Meta-ExternalAgent, Meta-ExternalFetcher, cohere-ai, Diffbot, DuckAssistBot, YouBot) at the Cloudflare edge so AEO investments (FAQPage schema, self-contained FAQs, citation-ready answers) become visible to AI answer engines. Prior state: every listed UA received HTTP 403 on soleur.ai/*.
• Broaden the cf_api_token_rulesets Doppler secret's documented scope from Cache Rules:Edit only to Cache Rules:Edit + Zone WAF:Edit, reflecting the alias's new second consumer.

Plugin

• terraform-architect agent: three new Sharp Edges bullets — narrow-token plan-vs-apply scope asymmetry, variable-description drift on alias reuse, UA substring-collision avoidance. Do-not-add-managed-WAF-skip warning.

v3.55.0 — 2026-04-19

Plugin

• New skill admin-ip-refresh — detects drift between current operator egress IP and Doppler prd_terraform/ADMIN_IPS, shows a diff, mutates Doppler with explicit per-command ack (no --yes), emits the exact terraform plan + apply invocations for operator execution. Three-service IP detection fallback (ifconfig.me → api.ipify.org → icanhazip.com) with strict IPv4 octet regex, RFC1918/loopback/link-local filter, and curl --max-filesize 64 to harden against hostile providers.
• New plan-skill reference — plan-network-outage-checklist.md codifies L3→L7 hypothesis ordering (firewall → DNS/routing → TLS/proxy → application). Triggered on case-insensitive match against SSH, connection reset, kex, firewall, unreachable, timeout, 502/503/504, handshake, EHOSTUNREACH, ECONNRESET. Wired into plan/SKILL.md Phase 1.4 and deepen-plan/SKILL.md Phase 4.5.
• New AGENTS.md Hard Rule — hr-ssh-diagnosis-verify-firewall (545 bytes, [skill-enforced: plan Phase 1.4, deepen-plan Phase 4.5]).
• New operator runbook — knowledge-base/engineering/ops/runbooks/admin-ip-drift.md with diagnostic decision tree (L3→L7), automated + manual recovery paths, sharp edges, do-not list, and CLI-verification annotations. Bidirectional cross-link with sibling ssh-fail2ban-unban.md.
• Skill description budget rebalance — trimmed fix-issue, feature-video, and dhh-rails-style descriptions to fit the 1800-word cap after adding admin-ip-refresh (final total 1800/1800, bun test plugins/soleur/test/components.test.ts passes 1006/0).
• Work and plan skill instruction additions — work Phase 2.5 gains a bullet on chaining cd <worktree> && <cmd> in single Bash calls; plan Sharp Edges gains a bullet on measuring pre-plan budget headroom before adding a new skill or AGENTS.md rule (both routed from this session's error inventory).

Knowledge base

• New learning bug-fixes/2026-04-19-admin-ip-drift-misdiagnosed-as-fail2ban.md captures the layer-ordering failure class and the three-layer fix, with ## Session Errors enumerating the process errors during this one-shot run.
• 2026-03-19-ci-ssh-deploy-firewall-hidden-dependency.md gains an "Update 2026-04-19" section pointing to the new artifacts so a future reader of either learning can find both from either direction.

v3.54.0 — 2026-04-19

Web Platform

• Added apps/web-platform/infra/resource-monitor.sh + test harness (11 passing shell tests) provisioning host CPU/RAM/session monitoring with per-threshold email alerts via Resend.
• Added apps/web-platform/infra/cloud-init.yml + server.tf entries to deploy the monitor on both fresh and existing Hetzner servers.
• Added /internal/metrics route on the custom HTTP server, loopback Host: gated. Returns host CPU/RAM proxy (loadavg/nproc), mem pct (MemAvailable), load_avg_1m, active_sessions, active_workspaces.
• Added server/session-registry.ts + server/session-metrics.ts to decouple session counting from the ws-handler module graph.
• Changed /health response: preserved original 6-field shape; capacity + session fields moved to /internal/metrics to close a DoS-tuning + user-count-leak risk flagged by security review.

Knowledge Base

• Added learning 2026-04-19-enoent-on-optional-mount-should-not-alarm.md capturing the QA-caught runtime bug + 8 other review/QA-phase lessons.
• Added 2 new sharp-edge bullets to the work SKILL (module-level binding extraction, reportSilentFallback ENOENT filtering).
• Updated knowledge-base/product/roadmap.md row 4.8: priority P1 → P2; refs #1052 + #673.

v3.53.3 — 2026-04-19

Plugin

• fix(docs): JSON-LD interpolations now use a dedicated jsonLdSafe filter that prevents HTML autoescape leaks, </script> breakout, and U+2028/U+2029 line-separator hazards.
• test(docs): new bun:test suite renders a weaponized fixture and enforces the filter across every .njk template via a directory-walking drift-guard.
• docs(skill): soleur:plan Sharp Edges now prescribes directory-walking drift-guards over hardcoded file lists and enumerates the three hazard classes for JSON-in-HTML fixes.

v3.53.2 — 2026-04-19

Plugin

• plugins/soleur/skills/review/SKILL.md: generalized the gh --jq --arg Sharp Edge into a class-wide rule covering any reviewer-prescribed CLI flag — verify via --help before applying.

Knowledge base

• New plan: knowledge-base/project/plans/2026-04-19-chore-aeo-presence-reaudit-after-pr-2596-plan.md
• New learning: knowledge-base/project/learnings/best-practices/2026-04-19-verify-reviewer-prescribed-cli-flags-before-applying.md
• Spec dir: knowledge-base/project/specs/feat-one-shot-2615-aeo-presence-reaudit/

v3.53.1 — 2026-04-19

Plugin

• agents/product/design/ux-design-lead: clarified screenshot export must be direct children of screenshots/ (not nested subfolders), with git check-ignore verification step, and codified continuing existing NN- numbering per folder.

Knowledge Base

• product/design/billing/upgrade-modal-at-capacity.pen + 3 screenshots — at-capacity modal wireframe (Solo and Startup variants).
• project/learnings/best-practices/2026-04-19-design-screenshot-gitignore-unignore-direct-children-only.md — the gitignore-pattern learning.

v3.53.0 — 2026-04-19

Web Platform

• Test: Add cross-workspace isolation suite (test/sandbox-isolation.test.ts) covering tier-4 process isolation (direct bwrap) and full-stack SDK sandbox (query()).
• Test helpers: Add test/helpers/sandbox-isolation-fixtures.ts with pure-node bwrap/fixture primitives.

Plugin — Soleur

• Skill (work): New Phase 2 test bullet — retry-on-flake logic must assert the invariant across every attempt, not just the last.
• Skill (plan): Prior commit on this branch routed plan to document the concurrency-enforcement ADR.
• Skill (git-worktree): Prior commit on this branch routed git-worktree to document the silent-registration-failure class.

Knowledge Base

• Constitution (Testing / Always): Two new rules — retry-attempt assertion pattern; bulk-cleanup helpers must refuse symlinks at entry level.
• Learning: test-failures/2026-04-19-retry-once-early-return-masks-first-attempt-failures.md — full writeup of the PR #2610 retry-once bug class, fix pattern, and six additional session errors.
• Learning: best-practices/2026-04-19-llm-sdk-security-tests-need-deterministic-invocation.md (prior commit).
• Learning: 2026-04-18-worktree-manager-silent-registration-failure.md (prior commit).
• Spec artifacts: knowledge-base/project/specs/feat-verify-workspace-isolation/{spec,tasks,sdk-probe-notes}.md document the Path C design, the reverse-engineered + empirically-captured SDK bwrap argv, and the MU3 acceptance criteria.

v3.52.3 — 2026-04-19

Plugin

• Adapter hard-fails on missing PENCIL_CLI_KEY, emitted before MCP SDK resolution via dynamic imports + try/catch wrapper.
• classifyResponse (extracted pure module) now flags auth-failure REPL strings (pencil login, Invalid API key, Unauthorized, HTTP 401) as errors; regex patterns anchored to reduce false positives on user content.
• shouldSkipSave (extracted pure module) gates all 3 auto-save call sites (registerMutatingTool, set_variables, open_document); stderr emits SKIPPED save traces. Explicit save tool emits observability NOTE but runs at caller's request.
• check_deps.sh --check-adapter-drift subcommand: sha256 match → OK; mismatch → DRIFT exit 3; --auto re-copies via copy_adapter.sh; absent install → NOT_INSTALLED.
• copy_adapter.sh syncs adapter + 4 sibling pure modules into install location; uses npm ci --ignore-scripts; unlinks pre-existing symlinks before cp (prevents a local attacker from redirecting copies via planted symlinks).
• ux-design-lead post-save size gate (stat -c %s > 0), canonical path enforcement, explicit "do not fabricate stub narrative" instruction pointing at the diagnosis checklist.
• pencil-setup/SKILL.md fixed broken claude mcp list -s user → plain claude mcp list; added copy_adapter.sh + drift-check steps.

Meta

• AGENTS.md rule cq-pencil-mcp-silent-drop-diagnosis-checklist codifies the diagnosis order (env → drift → file size) so future sessions don't re-invent the "stub" explanation.
• brand-guide.md source-file path corrected from knowledge-base/design/ to canonical knowledge-base/product/design/.
• Learning file knowledge-base/project/learnings/bug-fixes/2026-04-19-ux-design-lead-headless-stub-fabrication.md captures the full misdiagnosis + fix chain + 3 session-error prevention notes (grep-tests-see-through-negation, static-imports-incompatible-with-env-gates, read-before-edit).
• Tests: 6 new (pencil-adapter auth hard-fail, classification, save-gate, check-deps drift with case-isolated fixtures, ux-design-lead output-path guard, SKILL.md CLI form).

v3.52.2 — 2026-04-19

Plugin (Soleur)

• Workflow: New close-orphans job in .github/workflows/codeql-to-issues.yml. Sweeps open type/security issues; closes any whose referenced CodeQL alert numbers are all state == dismissed. Honors keep-open label as escape hatch. Caps per-issue alert lookups at 50 (DoS hardening).
• Workflow (retroactive fix): check-alerts job rewritten to use done < <(...) process substitution so CREATED/SKIPPED counters survive past the loop. Pre-existing telemetry bug fixed per wg-when-fixing-a-workflow-gates-detection.
• Triage skill: Added "CodeQL alert-state precheck" subsection.
• AGENTS.md: Added 2 cq-* rules (cq-prose-issue-ref-line-start, cq-workflow-pattern-duplication-bug-propagation).

Knowledge base

• New learning: best-practices/2026-04-19-codeql-orphan-issue-post-dismissal-sweep.md (workflow gap diagnosis + sharp edges).
• New learning: best-practices/2026-04-19-markdownlint-fix-mangles-issue-ref-at-line-start.md (prose convention + 6-item session error inventory).
• New evidence: specs/feat-one-shot-codeql-2368/{verification.md,web-platform-alerts.json,tasks.md}.

Notes

• The original issue counted 9 logical alerts; test/workspace.test.ts produced two alert numbers (#102, #103) for two different lines, so the inventory has 10 entries.
• No production code touched; verify-and-close framing per CTO assessment in brainstorms/2026-04-16-security-scanning-alerts-brainstorm.md.

v3.52.1 — 2026-04-19

Docs / Marketing

• Cloud-primary rewrite of the Getting Started page (new hero, FAQ, and "Run it yourself" section).
• Sitewide "Reserve access" nav CTA + "Hosted version (coming soon)" footer entry.
• Pricing page waitlist section moved above the pricing cards.
• FAQ codepoint parity normalization (prevents Google FAQ rich-result drift).
• Nav CTA focus ring (WCAG 2.4.7).

v3.52.0 — 2026-04-19

Minor

• Renamed cleanup-scope-outs skill to drain-labeled-backlog (framing now matches its label-generic implementation; no behavior change)
• Added drain intent to /soleur:go routing — users can now say "drain the X backlog" to trigger the skill
• Added Sharp Edge to review/SKILL.md clarifying the skill word-budget tokenizer (separate learning committed)

web-v0.48.1 — 2026-04-19

• Infra: terraform_data.fail2ban_tuning now installs fail2ban opportunistically before dropping the jail.d override, with a post-install dpkg verification step.
• Infra: cloud-init gains a systemic packages: audit that catches silent apt failures on first boot for all declared packages (currently curl, fail2ban, jq).

web-v0.48.0 — 2026-04-19

Web Platform

• Added apps/web-platform/infra/resource-monitor.sh + test harness (11 passing shell tests) provisioning host CPU/RAM/session monitoring with per-threshold email alerts via Resend.
• Added apps/web-platform/infra/cloud-init.yml + server.tf entries to deploy the monitor on both fresh and existing Hetzner servers.
• Added /internal/metrics route on the custom HTTP server, loopback Host: gated. Returns host CPU/RAM proxy (loadavg/nproc), mem pct (MemAvailable), load_avg_1m, active_sessions, active_workspaces.
• Added server/session-registry.ts + server/session-metrics.ts to decouple session counting from the ws-handler module graph.
• Changed /health response: preserved original 6-field shape; capacity + session fields moved to /internal/metrics to close a DoS-tuning + user-count-leak risk flagged by security review.

Knowledge Base

• Added learning 2026-04-19-enoent-on-optional-mount-should-not-alarm.md capturing the QA-caught runtime bug + 8 other review/QA-phase lessons.
• Added 2 new sharp-edge bullets to the work SKILL (module-level binding extraction, reportSilentFallback ENOENT filtering).
• Updated knowledge-base/product/roadmap.md row 4.8: priority P1 → P2; refs #1052 + #673.