release: 0.18.0 — The rest of the readers

[fdaviddpt]

Two merged PRs since v0.17.0 (eeb7a62): #329 and #331. Both close the same defect class in the readers v0.17.0 did not reach.

The changelog was crediting v0.17.0 with work that shipped after it

#329 merged after the v0.17.0 tag commit, and its two paragraphs were appended to #322's bullet inside the released ## [0.17.0] section. The tag was cut before #329 existed, so the GitHub release notes rendered from that tag do not contain those paragraphs — while the file on main does. The file and the published release already disagreed, and the file gave 0.17.0 credit for a change it does not contain.

So this release does not add a duplicate entry beside the old text. It moves it: the two paragraphs are removed from 0.17.0 and rewritten, together with the half that was never documented anywhere, as the 0.18.0 entry for #329. That restores agreement with the published v0.17.0 notes rather than breaking it.

The half of #329 that was undocumented

The commit subject is "the third reader of the same marker, and a freeze guard that outlived its claim", and only the first half had ever been written down.

test_case_divergence_298.py held scripts/post-tool-hook.sh byte-equal to origin/main. Byte-equality asserts "nobody has edited this file since main", which is a different claim from the one #298/#299 care about, and it fails in both directions: it blocked an unrelated one-token arithmetic guard, and it goes vacuous the moment the edit it objected to lands on main. #329 replaced that arm with a direct assertion of the property — the per-tool-call path does not source the divergence library, does not call the check, and spawns no git. The other two arms keep the byte compare; they were not what blocked.

What 0.18.0 contains

• fix(#322): the third reader of the same marker, and a freeze guard that outlived its claim #329 — post-tool-hook.sh was the third reader carrying the digits-only case with no 10#, at both file-sourced operands. The notice reader is the one that loses something: the if body bash abandons is the body holding an exit 0, so the hook runs past it and the line below the fi deletes the notice marker as though a transcript had been found. Both sites are pinned on behaviour rather than the diagnostic, because this hook writes to hook-errors.log and not to stderr — a stderr-only assertion is green against the unfixed hook.
• 10# landed in save-session.sh only — 50-git-backup.sh still takes the octal path, where set -u makes it fatal, and a new test's docstring claims otherwise #327 — the same guard was missing from both git hooks, at seven sites rather than the one the issue names. Four are consecutive-failure counters, and those are the worse ones: the abandoned branch is the one holding log "ERROR: push REJECTED …". A corrupt counter did not mis-count, it silenced the loudest report in the file.
• #258's regression test writes the cooldown marker to a path the hook no longer reads, so every corrupt value passes trivially #324 — Cooldown and lock robustness in 50-git-backup.sh: a corrupt marker bypasses the throttle, and the marker is only written on success #258's regression test wrote its marker where a compatibility shim happened to carry it, so the test's transport was the shim rather than the feature. 08/09 were also absent from the parametrization, and the assertions could not fail on the platform they ran on.

Two of the three issues had a severity or mechanism claim that did not survive measurement, and the entries say so rather than repeating the filed text.

Version

Two places, verified by sweep rather than recipe: .claude-plugin/plugin.json and the CHANGELOG.md heading. This repo has no pyproject.toml version field and no supertool-style four-file spread. eeb7a62 touched exactly these two, and so does this.

No link-reference definitions were added — this file has never had any, every issue link is inline, and eeb7a62 added none either.

test_version_manifest.py (semver, manifest-vs-newest-heading equality, descending heading order): 4 passed.

Noted, not fixed here

README.md:9's version badge reads 0.8.3 and has been frozen across nine releases. A release commit matching eeb7a62's shape has no business touching it and no test guards it — filed separately.