chore(release): v1.9.4 — collision-safe MCP and reproducible installs

[davesheffer]

Release

Cuts Hunch v1.9.4 with the user-facing changes merged in #25 and #26:

• isolate MCP roots and simultaneous decision captures across repositories
• pin generated MCP, hook, plugin, and CI launchers to the exact npm package version
• remove the retired GitHub-tarball and stale-global execution paths
• refresh exact install/audit instructions and English/localized changelogs

Release-safe guard bootstrap

The first PR run exposed a release bootstrap deadlock:

npm error code ETARGET
npm error notarget No matching version found for @davesheffer/hunch@1.9.4.

The repository Hunch Guard now installs the exact package version recorded on the trusted PR base branch. A release PR therefore runs the published main checker instead of trying to download its own unpublished candidate, while generated consumer CI still pins the candidate's exact release.

Version surfaces

• package.json and package-lock.json: 1.9.4
• Claude plugin and MCP launcher: exact @davesheffer/hunch@1.9.4
• generated consumer Hunch Guard: exact @davesheffer/hunch@1.9.4
• repository PR guard: exact trusted-base version (1.9.3 for this release PR)
• README, cookbook, site docs, audit examples, and localized changelogs: 1.9.4

Historical v1.9.3 changelog entries remain unchanged.

Validation

• npm run typecheck
• npm run build
• 23/23 release-specific tests passed
• release-bootstrap regression test observed red on the old workflow, then green after the fix
• trusted-base resolver returned 1.9.3, verified present on npm
• npm pack --dry-run --json produced @davesheffer/hunch@1.9.4
• Hunch merge verdict: PASS
• Hunch intent conformance: 4/4 satisfied

A broader local Windows batch had five environment-only failures: one locale test could not obtain distinct default collations, and four symlink tests received EPERM. The full GitHub release and platform gates are the release authority.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hunch	Ready	Preview, Comment	Jul 26, 2026 10:46am

[github-actions]

🧠 Hunch — Engineering Memory Guard

✅ This PR touches no recorded invariants (directly or via blast radius) and re-introduces nothing deliberately retired across 25 changed file(s).

📜 Hunch Constitution — 2 policy receipt(s)

• ✅ pol_01cf084e1e satisfied — symbol:renderAdoptedDoc does not reach symbol:writeFileAtomic
  • receipt: sha1:e7be26e91e25651272831d80ceb8b10cf6b9650f
• ✅ pol_3f3aee11ad satisfied — symbol:src/store/db.ts:openDb does not reach external:better-sqlite3
  • receipt: sha1:c98e5e5a4be6e00c05d20da454456b36824156ae