release: v1.3.187 kernel history preservation

[dofastted]

Changes

• Ship the corrected Claude kernel through a new pinned payload release; preserve unknown message blocks and extension fields on known types through the native CLI hop.
• Retain continuation tool-result ID and size checks. No Codex kernel or other payload byte changes.
• Cut v1.3.187 and include the already-merged stream Usage Policy / idle-timeout fixes in the version notes.

Verification

• Kernel source suite: 116 passed, 1 ignored (prior build verification).
• Actual release ELF -> existing CLI -> local upstream: per-message effort and signed-thinking integration scenarios passed (2/2).
• Build output, installed binary, shared copy, live deployed kernels, and payload re-download independently match SHA256 39996c1e39399cdae63aac188b1fcaa7814f3d51ca905d5f6911e95b6dd5de56 (12844112 bytes).
• All 11 payload assets checked against the manifest; only kernel bytes changed. Payload prerelease is not latest.
• No private source, credentials, production identifiers, or binaries added to git. Existing user worktree changes are excluded.

Upgrade

Update the control plane and payload. Drain requests before synchronizing/restarting changed local Claude kernels; remote baked-kernel slots require a rebuilt slot image and container reload. Already-installed matching kernel bytes do not need another replacement. No new dependencies or database migrations.

New-session live cache reuse was observed; this does not claim the original historical cache-break incident has been fully diagnosed.

---

Note

Medium Risk
Ships a new Claude kernel that changes how conversation history is serialized to the native CLI hop—a core inference path—though scope is limited to preservation rules and existing tool_result guards.

Overview
Cuts v1.3.187 and pins a new Claude kin-kernel payload (payload-2026.10.17-history, SHA256 39996c1e…, ~12.8MB). Only the kernel asset bytes change in deploy/payload.json; Codex kernel and the rest of the manifest stay on the prior hashes.

Release notes document the kernel behavior change: unknown message blocks and extension fields on known types (thinking bindings, citations, tool-call provenance) are kept through the native CLI hop instead of being dropped silently; extended tool_result still goes through continuation ID and size checks.

The changelog also formalizes two fixes already merged elsewhere—Anthropic streaming event: error remapped via mapUpstreamError for Usage Policy (policy_blocked / refusal_guard), and gateway streaming honoring KIN_STREAM_IDLE_TIMEOUT with the same cascade as the panel and kernel.json (default 180s)—and removes them from the unreleased section.

Upgrade: refresh the Node control plane and payload; drain in-flight work before syncing/restarting local Anthropic kernels; remote baked-kernel slots need a rebuilt image and container reload. Slots already on the matching kernel hash can skip replacement.

^{Reviewed by Cursor Bugbot for commit fcf1da1. Configure here.}