[acamarata]

Five low debt rows. No hq edits, no version bumps, no release.

D-0662 (fixed)

• plugin.checkReverseDependencies now returns plugin directory names (was manifest names) and reports a plugin.json that exists but cannot be read or parsed as *UnreadableManifestsError instead of skipping it. Dot-prefixed folders and .prev backups are not scanned for unreadable files.
• plugin remove refuses (hint: fix it or --force) when another plugin's manifest is unreadable.
• bundle remove (keepDependedOn) refuses before removing anything when an outside plugin's manifest is unreadable; an unreadable manifest of a planned member does not block (broken members stay removable). Dependents compare by directory name, so a manifest name equal to a planned member in another directory no longer counts as planned.
• bundle install clears that bundle's stale remove intent when the ledger is recorded (a failed clear is a warning, other bundles' intents untouched).
• Wiki: Bundles.md gains the Resume and Kept-for-a-dependent bullets; cmd-bundle.md mentions the refusal and the clear.
• Tests: reverse_deps_test.go, remover_deps_unreadable_test.go, installer_intent_test.go. The directory-name test fails against the old m.Name return (checked by temporarily reverting that line).

D-0751 (fixed)

cmd-config.md validate PROSE block now describes the unquoted/double-quoted $ warning (file, line and key only, never the value; ${NAME} not flagged; stderr only, no exit-code or --json change). make cmd-inventory and make wiki-check clean.

D-0762 (fixed)

• v1.4 consent warning under --json is now recorded with output.AddDeprecation (old nself <path> without --yes, new nself <path> --yes, removal v1.5.0), also when the stderr line is silenced. Test: TestDataLossGateJSONDeprecation.
• cmd-migrate.md, Upgrade-From-v0.9.md, Upgrading-from-v1.md: rollback examples pass --yes, plus a note on the v1.5 E403 refusal off a terminal.

D-0735 (fixed, by cutting test time; timeout not raised)

Profiled go test -json ./cmd/commands locally (270s; the Intel runner takes 334s, 2.4x the other legs). Causes: four go build ./cmd/nself per package run, and TestPilotJSONUnderV15Guard re-running the subprocess "live" subtests that ignore its t.Setenv (runPilot rebuilds the child environment).

• MCP integration and deprecation-wiring tests use the shared pilotBinary(t) (one build). TestSurfaceIdentity keeps its own build: it runs in a fresh process.
• The three "live" pilot subtests skip under the guard; the standalone tests still run them.
• Ratchet: TestCommandsTestsShareOneNselfBuild (fails if a cmd/commands test builds ./cmd/nself itself).
• Result locally: 274s -> 195s. I could not run the darwin/amd64 runner; the Intel number should drop by a similar share. Left alone: TestDBHasuraNoEnvSyncApplyRefLocalGolden/sync (15s), not investigated.

D-1165 (fixed)

proxy-swap-e2e.yml: the Round-trip and Kill-mid-remove steps now run on pull_request as well as the dispatched round-trip leg. Test: TestProxySwapRecoveryLegsRunOnPullRequests (fails on the old workflow). Prior PR runs take about 7 minutes for add + renew, so two more legs should fit the 40-minute job cap, but I could not run the legs here (no Docker); the first PR run of this workflow is the real check.

Commands run

• go build -mod=vendor ./..., go vet -mod=vendor ./..., gofmt -l: clean
• go test -mod=vendor ./internal/plugin/... ./internal/bundle/...: pass
• go test -mod=vendor ./cmd/commands (full): pass (195s)
• go test -mod=vendor ./internal/repoqa/... ./tools/wikigen/...: pass
• make cmd-inventory, make wiki-check, bash scripts/ci/workflow-lint.sh: clean