docs: add v1.0.38 release notes

.github/releases/v1.0.38.md

@@ -0,0 +1,49 @@
+## opencode {VERSION}
+
+{Prerelease/Stable} release from `{branch}` branch. Two quality deliveries land in this train: a five-front resource-leak fix wave (hook process groups, share listeners, TUI subscriptions, process-stop escalation, memory retention) and a DAG workflow-tool consistency pass (builtin:// spec_path round-trip, worker_type catalog, parameter descriptions verified against implementation), both hardened by a two-axis review round.
+
+---
+
+### 🐛 Bug Fixes
+
+- **Hook command grandchildren can no longer hang triggers, #500**: a timed-out hook shell command left pipe-holding grandchildren alive because only the direct child was killed; the timeout path now kills the whole process group (negative-pid SIGKILL, consistent with the detached spawn), with regression tests asserting group death under 15s.
+- **Share instance event listeners unsubscribe on dispose, #501**: five EventBus subscriptions accumulated across share lifecycles; dispose now collects and runs every returned unsubscribe before closing the scope.
+- **TUI route and prompt event subscriptions clean up on unmount, #502**: Session and Prompt routes registered bus listeners without onCleanup, leaking one listener set per navigation; both routes now wrap subscriptions in onCleanup with a regression suite pinning the subscription seam.
+- **Process stop awaits exit with SIGKILL escalation, #503**: Process.stop and the MCP client shutdown sent a single SIGTERM and never waited; both now run SIGTERM, a 3s grace, SIGKILL, and a bounded exit await, and the SDK copy mirrors the escalation. The index.ts exit-path clause was attempted as a bounded drain window and reverted on CI evidence: real session paths keep ref'd handles alive, so every CLI exit degraded to the 5s fallback and three subprocess lifecycle tests failed; the empirical record and a follow-up proposal (eliminate the residual handles first) are posted to the issue.
+- **Memory generations and heap snapshots are bounded, #504**: every memory commit copied the full topic set into a generations directory that was never removed (now keeps the latest 3 plus an orphan-staging sweep, best-effort so cleanup never fails a commit), and RSS-storm heap snapshots (hundreds of MB each) now rotate to the latest 2. Review caught a pid-led lexicographic sort that could delete the newest snapshot across runs; pruning now orders by the embedded timestamp with a cross-pid regression test.
+- **The workflow tool accepts the spec_path its own list action returns, #506**: list returned builtin:// refs that start/extend/read/validate rejected as unknown saved workflows; resolveSpecPath now round-trips the builtin:// scheme through the template registry with the same not-found diagnostics as bare names.
+- **worker_type catalog lists the native primary agents, #507**: build and plan were missing from the workflow tool's dynamic worker_type enum (the task tool surface is unchanged), so graphs could not name them.
+
+---
+
+### ⚙️ CI / Engineering
+
+- CI typecheck and test gates now also trigger on ready_for_review (#315 anchor): SpecGit deliveries open as draft, and converting to ready previously never started the required checks, permanently blocking specgit finish.
+- SpecGit harness refreshed for the 1.10.1 CLI with every local specialization preserved, and the AGENTS.md replay list corrected (pinned version, 45/40-minute timeout split, node 22, hand-parsed policy.yaml) so the next re-init replays reality instead of a stale 0.5.0 setup.
+- DAG parameter descriptions verified line-by-line against implementation, #508: timeout_ms (admission-to-completion budget, expired queued nodes fail without spawning, capped parent-adjudicated extensions), the review field (the full diff-review wiring contract and its standard-warns / deep-errors mode split), plus the workflow guide tables; stale tool-parameter snapshots regenerated.
+
+---
+
+### 🧪 Test Summary
+
+```
+unit tests (linux):   4447 tests, 4423 pass, 0 fail (364 files)
+e2e app tests:        21 passed on linux, 21 passed on windows
+httpapi exerciser:    230 pass x coverage/auth/effect, 0 fail, 0 skip
+typecheck:            29/29 packages green
+delivery-specific:    workflow tool/schema/parameters/review 194 pass; process/heap/memory 76 pass
+lint:                 oxlint 4840 warnings, 0 errors (ratchet budget 4850)
+```
+
+---
+
+### 🔍 Verification
+
+- Two-axis four-way code review (Standards and Spec, per delivery branch) over the full train diff; every P1 finding was independently re-verified against implementation code before fixing (heap prune ordering, stale parameter snapshot, the missing #503 clause).
+- specgit finish exited 0 (accepted) for both deliveries against real git, PR, and CI evidence.
+- The bounded-exit-window attempt for #503 was reverted on linux CI evidence and the empirical record posted to the issue; the revert kept the documented hanging-subprocess backstop intact.
+- Known residue tracked outside this train: one dependabot high-severity alert on the default branch (security/dependabot/110).
+
+---
+
+**Full changelog:** [`{previous_tag}`...`{current_tag}`](https://github.com/LeXwDeX/OpenCode-GraphAgent/compare/{previous_tag}...{current_tag})

.specgit.yaml

@@ -1,23 +1,11 @@
 version: 1
-delivery: hook-command-grandchildren
+delivery: release-notes-v1-0-38
 context:
   kind: branch
-  branch: fix/500-hook-command-grandchildren
+  branch: docs/510-release-notes-v1-0-38
 issues:
-  - 500
-  - 501
-  - 502
-  - 503
-  - 504
+  - 510
 issueKinds:
-  - issue: 500
-    kind: kind::fix
-  - issue: 501
-    kind: kind::fix
-  - issue: 502
-    kind: kind::fix
-  - issue: 503
-    kind: kind::fix
-  - issue: 504
-    kind: kind::fix
-pr: 505
+  - issue: 510
+    kind: kind::docs
+pr: 511