release: 0.19.0 — a compaction is not a new session

[fdaviddpt]

Release 0.19.0 — five PRs since v0.18.0 (2026-08-08).

What ships

#340	A compaction no longer re-injects the whole memory recap (#339, reported by @derekwitucki)
#323	A save can no longer drop "blocked on you" while keeping "deployed" (fixed by @turbomotioncat)
#338	Stale docs/validators.md citations (#333); README badge pinned to the manifest (#335)
#337	batch declared in .supertool.json
#336	A cooldown marker ahead of now no longer sticks the throttle on permanently (#326, #332)

Two of the five came from outside the org, which is a first for this tracker.

The headline change

SessionStart fires at every auto-compaction, and the hook read session_id out of that payload while discarding source — so every memory file was re-cat'd into a context that had just been replaced by a summary. The reporter measured compact firing about as often as startup across 40 days.

At source=compact the bodies are no longer repeated, with one exception: identity.md works by presence, and no other line of the hook's output even names the file. Everything else is named with its byte size rather than dropped — #124's vocabulary for "kept but not injected", because a recap that shrinks in silence is indistinguishable from a store that emptied.

Unrecognised input runs the old way. No source, an empty value, a spelling from a future release, or no stdin at all all fall through to today's full output. An absence read as compact would silently stop injecting memory for anyone whose payload shape differs from the one the heuristic was written against — the failure this plugin exists to prevent.

Two CHANGELOG entries added here, not in their own PRs

#323 and #337 merged without one, so they would have shipped unrecorded. #323 is an external contributor's fix, and the CHANGELOG is where that shows up. Both entries are written in this release commit rather than backfilled into merged PRs.

Release mechanics

Three version sites, all at 0.19.0: .claude-plugin/plugin.json, the README badge, and the CHANGELOG heading. tests/test_version_manifest.py — 5 passed locally. A residual sweep for 0.18.0 across all tracked files (no extension allowlist, per #335's lesson) returns nothing outside CHANGELOG.md.

The plugin.json bump silently no-matched on the first attempt and was caught by reading the file back rather than by trusting the edit's exit. That is the half-bumped release the version guards exist to prevent, and the read-back is what found it.

Gates

• main green at leg level on e506937 — 12/12, one workflow declared (tests), one dispatched, none unaccounted for.
• Gate zero: board triaged, every open issue carries a priority. Nothing blocking.
• Security audit of v0.18.0..e506937: round 1 in flight — this does not merge until it reports. An audit that did not run must never read as an audit that found nothing.
• No cohort freeze: this repo has no cohort-* mechanism, verified rather than assumed.