[LynxTWO]

Stable catalog updates currently resolve the development checkout. Pin the existing marketplace identities to the published unified.18 commit independently of the preview VERSION, preserving historical metadata verification. Use explicit HTTPS URLs so native Claude updates do not depend on SSH host-key setup, and link to the one shared opt-in preview catalog in Scaffold Kit.

Skill instructions, status semantics, approvals, verification capabilities and version parsing are unchanged. The only runtime helper change generates inert catalog metadata.

Validation:

• Both native hosts passed Git catalog refresh, explicit preview installation and rollback on macOS. Every tracked source file and the core inventory matched the selected stable/candidate commits; stable refresh installed no preview plugin after the remote review branches advanced.
• The first Claude github-source update failed SSH host-key verification; evidence retains it. The explicit-HTTPS rerun passed without changing SSH configuration.
• Original settings and permanent stable cache bytes were restored exactly. Forced updates were exercised; no background timer is claimed. Native Windows/Linux plugin installs remain untested.
• Packaging regressions: 12 passed, five passing subtests. Clean tracked archives pass universal and distribution validation with zero errors/warnings. The initial working-tree audit reported a generated-bytecode warning; it was not a source error. Strict Claude catalog validation passed with non-blocking README installation advice. Historical unified.18 and the local candidate tagged release check pass; the local rehearsal tag was not pushed.
• Evidence: design/evals/product-v1/documentation-evidence-2026-10-14-catalog-isolation.json. CI run 38655315566 passed on dccf935e72c4da7c4116219a7144beb87c9bccdb: all 14 jobs succeeded, including four mutation shards, the aggregate gate and PR-only shadow evidence. Linux 3.12/3.13, macOS 3.12 and international paths each report 759 passed, eight skipped and 706 passing subtests. Windows reports 762 passed, five skipped and 710 passing subtests; C locale reports 758 passed, nine skipped and 706 passing subtests. Individual skip reasons were not printed by these CI commands.

Merged after review with no blockers. Stable protection is now on main. Plugin publishing remains on hold: no release tags, GitHub releases, release assets or directory submissions. The shared preview catalog pins the tested source commit ac4c5895e7cf42d4bb2d86c29d8528bcafae6992; subsequent commits change outer documentation and evidence.

Post-merge verification (2026-10-15 UTC / October 14 America/New_York): merge commit eae4ce61c2c6c51eb6f0af7e2c95fce6244f413a has the exact reviewed tree. Tests passed: 13 successful jobs, including all four mutation shards and aggregate gates. The PR-only shadow evidence job was intentionally skipped on push. Linux 3.12/3.13, macOS 3.12 and international paths each report 759 passed, 8 skipped and 706 passing subtests; Windows reports 762 passed, 5 skipped and 710 passing subtests; C locale reports 758 passed, 9 skipped and 706 passing subtests. No test failures. Individual test skip reasons were not printed by these CI commands. Pages deployment passed. Plugin publishing remains on hold; no release tags, releases, release assets or directory submissions were published.