diff --git a/.changes/harness-ops/docs-harness-ops-held-rows-pilot-7b29b2d0.md b/.changes/harness-ops/docs-harness-ops-held-rows-pilot-7b29b2d0.md
new file mode 100644
index 00000000000..1a7f5ad6d7a
--- /dev/null
+++ b/.changes/harness-ops/docs-harness-ops-held-rows-pilot-7b29b2d0.md
@@ -0,0 +1,16 @@
+---
+bump: patch
+---
+
+### Fixed
+
+- `observability` no longer describes `cli-flag-verify` as a PostToolUse hook: guardrails runs it at push time in the `reference-verify` git hook, so the report marks hallucination-guard catches as not collected rather than reading an empty count as clean.
+- `plugins` no longer says `claude plugin list` shows the highest version across scopes: on 2.1.322 it prints one row per install record with its own scope and version, and still never says which row loads here.
+- `plugins` no longer tells a user to run `/reload-plugins` after every `Run /reload-plugins to apply.` summary: since 2.1.268 the `/plugin` panel can apply changes itself, so the two-step checks what the panel did (at the install pointer) and asks for a bare reload only when the plugin is still not active.
+
+### Changed
+
+- `plugins`: the shallow-clone reason for comparing only installs at the clone's HEAD points at the host-marketplace section that describes the re-clone, instead of restating it beside an unanchored link.
+- `lanes`: the cloud-session note points at agent view's "List sessions as JSON" section, and the schtasks payload limit points at the `/tr` row the config already cites.
+- `audit-skill-visibility`: the usage-counters reference names the binary reading the plugin-use definition rests on, and drops an unsourced polling rate and public-report remark.
+- Nine eval cases cover held re-audit rows across `changelog`, `plugins`, `audit-skill-visibility`, `lanes`, `audit-performance`, `observability` and `audit-native-overlap`.
diff --git a/plugins/harness-ops/evals/ano-summarized-fetch-not-evidence/case.yaml b/plugins/harness-ops/evals/ano-summarized-fetch-not-evidence/case.yaml
new file mode 100644
index 00000000000..f950cf91aeb
--- /dev/null
+++ b/plugins/harness-ops/evals/ano-summarized-fetch-not-evidence/case.yaml
@@ -0,0 +1,18 @@
+schema_version: "1.1"
+name: ano-summarized-fetch-not-evidence
+graders:
+  - name: fetch-answer-is-summary
+    type: regex
+    pattern: '\b(?:summary|summaries|summari[sz]\w*)|\bsmall(?:er)? model\b|\bparaphras\w*|\bmodel[’'']?s? (?:answer|reading|summary)\b|\bnot the (?:raw )?page\b'
+    flags: 'i'
+    target: last_message
+  - name: absence-not-evidence
+    type: regex
+    pattern: '\babsence\b[^.\n]{0,80}\bnot\b[^.\n]{0,40}\bevidence|\bnot\b[^.\n]{0,30}\bevidence of absence\b|\b(?:don[’'']?t|do not|cannot|can[’'']?t|shouldn[’'']?t|should not)\b[^.\n]{0,40}\brecord'
+    flags: 'i'
+    target: last_message
+  - name: uses-raw-page
+    type: regex
+    pattern: '\braw\b[^.\n]{0,60}\b(?:markdown|\.md|page|bytes|endpoint)|fetch-docs\.sh|\bskills\.md\b'
+    flags: 'i'
+    target: last_message
diff --git a/plugins/harness-ops/evals/ano-summarized-fetch-not-evidence/prompt.md b/plugins/harness-ops/evals/ano-summarized-fetch-not-evidence/prompt.md
new file mode 100644
index 00000000000..7129f22a542
--- /dev/null
+++ b/plugins/harness-ops/evals/ano-summarized-fetch-not-evidence/prompt.md
@@ -0,0 +1,10 @@
+---
+description: "One question audit-native-overlap answers: whether a WebFetch answer that omits a bundled skill proves Claude Code ships none (no: a summarizing fetch returns a model's answer about the page, so absence is not evidence; the claim needs the raw markdown). Reaches SKILL.md 'Any claim about what Claude Code itself ships'. Source: the consumer's own writing. routine. Read-only tools. Held-rows rows: harness-ops 15."
+tags: [harness-ops, audit-native-overlap, reference-answer, routine]
+max_turns: 15
+timeout_seconds: 300
+allowed_tools: [Skill, Read, Glob, Grep]
+expected_outcome: "The answer says no: a summarizing fetch returns a model's answer about the page, so absence from it is not evidence, and the claim must rest on the raw markdown page (fetch-docs.sh)."
+---
+
+/harness-ops:audit-native-overlap before a report: I asked WebFetch about https://code.claude.com/docs/en/skills and its answer didn't mention any bundled skill called `explain-usage`. Can I record that Claude Code ships no such skill?
diff --git a/plugins/harness-ops/evals/ano-summarized-fetch-not-evidence/samples/absence-not-evidence.json b/plugins/harness-ops/evals/ano-summarized-fetch-not-evidence/samples/absence-not-evidence.json
new file mode 100644
index 00000000000..5d22af6df37
--- /dev/null
+++ b/plugins/harness-ops/evals/ano-summarized-fetch-not-evidence/samples/absence-not-evidence.json
@@ -0,0 +1,18 @@
+{
+  "pass": [
+    {
+      "answer": "Absence from that answer is not evidence of absence.",
+      "why": "direct"
+    },
+    {
+      "answer": "You can't record that from a fetch answer.",
+      "why": "can't record"
+    }
+  ],
+  "fail": [
+    {
+      "answer": "Yes, record it.",
+      "why": "wrong"
+    }
+  ]
+}
diff --git a/plugins/harness-ops/evals/ano-summarized-fetch-not-evidence/samples/fetch-answer-is-summary.json b/plugins/harness-ops/evals/ano-summarized-fetch-not-evidence/samples/fetch-answer-is-summary.json
new file mode 100644
index 00000000000..98382992291
--- /dev/null
+++ b/plugins/harness-ops/evals/ano-summarized-fetch-not-evidence/samples/fetch-answer-is-summary.json
@@ -0,0 +1,18 @@
+{
+  "pass": [
+    {
+      "answer": "No. A summarizing fetch returns a small model's answer about the page.",
+      "why": "summary"
+    },
+    {
+      "answer": "WebFetch hands back a paraphrase, not the page.",
+      "why": "paraphrase"
+    }
+  ],
+  "fail": [
+    {
+      "answer": "No, read the raw markdown first.",
+      "why": "no reason"
+    }
+  ]
+}
diff --git a/plugins/harness-ops/evals/ano-summarized-fetch-not-evidence/samples/uses-raw-page.json b/plugins/harness-ops/evals/ano-summarized-fetch-not-evidence/samples/uses-raw-page.json
new file mode 100644
index 00000000000..0ad78e8073b
--- /dev/null
+++ b/plugins/harness-ops/evals/ano-summarized-fetch-not-evidence/samples/uses-raw-page.json
@@ -0,0 +1,14 @@
+{
+  "pass": [
+    {
+      "answer": "Fetch the raw markdown with fetch-docs.sh and search skills.md.",
+      "why": "raw"
+    }
+  ],
+  "fail": [
+    {
+      "answer": "Ask WebFetch again with a sharper question.",
+      "why": "refetch summary"
+    }
+  ]
+}
diff --git a/plugins/harness-ops/evals/ap-fanout-version-and-kthreads/case.yaml b/plugins/harness-ops/evals/ap-fanout-version-and-kthreads/case.yaml
new file mode 100644
index 00000000000..0084f77acaf
--- /dev/null
+++ b/plugins/harness-ops/evals/ap-fanout-version-and-kthreads/case.yaml
@@ -0,0 +1,23 @@
+schema_version: "1.1"
+name: ap-fanout-version-and-kthreads
+graders:
+  - name: subagents-carry-fanout
+    type: regex
+    pattern: '(?:hook|statusline|status line)\w*[^\n]{0,200}\b(?:each|every|per)\b[^.\n]{0,40}(?:sub-?agent|child)|\b(?:each|every|per)\b[^.\n]{0,40}sub-?agent[^\n]{0,200}(?:hook|statusline|status line)'
+    flags: 'i'
+    target: last_message
+  - name: version-fixes-slowdowns
+    type: regex
+    pattern: '\breleases?\b[^\n]{0,160}\bfix\w*[^\n]{0,120}\b(?:slow\w*|lag|cpu|regression\w*|quadratic|keystroke)|\bfix\w*[^\n]{0,120}\b(?:slowdown|lag|cpu|regression|quadratic|keystroke)\w*[^\n]{0,160}\breleases?\b'
+    flags: 'i'
+    target: last_message
+  - name: names-purge-lever
+    type: regex
+    pattern: 'claude purge\b'
+    flags: 'i'
+    target: last_message
+  - name: names-kthread-flag
+    type: regex
+    pattern: 'PF_KTHREAD|/proc/[^\s]*stat\b[^\n]{0,120}\bflags?\b|\bflags? field\b'
+    flags: 'i'
+    target: last_message
diff --git a/plugins/harness-ops/evals/ap-fanout-version-and-kthreads/prompt.md b/plugins/harness-ops/evals/ap-fanout-version-and-kthreads/prompt.md
new file mode 100644
index 00000000000..8e7611ce75f
--- /dev/null
+++ b/plugins/harness-ops/evals/ap-fanout-version-and-kthreads/prompt.md
@@ -0,0 +1,15 @@
+---
+description: "Four questions audit-performance answers from its text before running the engine: why modest concurrency and depth settings overload a host (every subagent carries the parent's statusline and hook fan-out), whether the Claude Code version can be the cause (releases fixed slowdowns), how to shrink ~/.claude.json (`claude purge <path>`), and how the leak count tells kernel threads apart (the PF_KTHREAD flag in /proc/<pid>/stat). Reaches SKILL.md suspects 2 and 5 and reference/known-performance-issues.md. Source: the consumer's own writing. routine. Read-only tools. Held-rows rows: harness-ops 17, 20, 25, 29."
+tags: [harness-ops, audit-performance, reference-answer, routine]
+max_turns: 20
+timeout_seconds: 400
+allowed_tools: [Skill, Read, Glob, Grep]
+expected_outcome: "The answer says each subagent carries the parent's hook and statusline fan-out so depth times concurrency multiplies it, that releases fixed slowdowns so the version can be the cause, names `claude purge <path>` for ~/.claude.json, and names the PF_KTHREAD flag in /proc/<pid>/stat."
+---
+
+/harness-ops:audit-performance don't run anything yet, I want to understand a few things first:
+
+1. I set the concurrent-subagent limit to 10 and allowed nesting three deep. Each setting looks modest, so why does my machine fall over when Claude fans out?
+2. I'm on Claude Code 2.1.205. Could the version itself be part of the slowness?
+3. Someone online said trimming `~/.claude.json` cured their input lag. Is that worth trying, and how?
+4. On Linux, how does the leak count tell kernel threads apart from user processes?
diff --git a/plugins/harness-ops/evals/ap-fanout-version-and-kthreads/samples/names-kthread-flag.json b/plugins/harness-ops/evals/ap-fanout-version-and-kthreads/samples/names-kthread-flag.json
new file mode 100644
index 00000000000..4a1d299d998
--- /dev/null
+++ b/plugins/harness-ops/evals/ap-fanout-version-and-kthreads/samples/names-kthread-flag.json
@@ -0,0 +1,18 @@
+{
+  "pass": [
+    {
+      "answer": "It reads the PF_KTHREAD bit in the flags field of /proc/<pid>/stat.",
+      "why": "flag"
+    },
+    {
+      "answer": "The flags field of `/proc/<pid>/stat` marks kernel threads.",
+      "why": "flags field"
+    }
+  ],
+  "fail": [
+    {
+      "answer": "It checks whether the parent pid is 2.",
+      "why": "ppid test"
+    }
+  ]
+}
diff --git a/plugins/harness-ops/evals/ap-fanout-version-and-kthreads/samples/names-purge-lever.json b/plugins/harness-ops/evals/ap-fanout-version-and-kthreads/samples/names-purge-lever.json
new file mode 100644
index 00000000000..74d77d492fc
--- /dev/null
+++ b/plugins/harness-ops/evals/ap-fanout-version-and-kthreads/samples/names-purge-lever.json
@@ -0,0 +1,14 @@
+{
+  "pass": [
+    {
+      "answer": "Use `claude purge <path>` to remove one project's entry.",
+      "why": "lever"
+    }
+  ],
+  "fail": [
+    {
+      "answer": "Edit ~/.claude.json by hand and delete old projects.",
+      "why": "hand edit"
+    }
+  ]
+}
diff --git a/plugins/harness-ops/evals/ap-fanout-version-and-kthreads/samples/subagents-carry-fanout.json b/plugins/harness-ops/evals/ap-fanout-version-and-kthreads/samples/subagents-carry-fanout.json
new file mode 100644
index 00000000000..0e7fb4390ba
--- /dev/null
+++ b/plugins/harness-ops/evals/ap-fanout-version-and-kthreads/samples/subagents-carry-fanout.json
@@ -0,0 +1,18 @@
+{
+  "pass": [
+    {
+      "answer": "Every subagent carries the same statusline and hook fan-out as its parent.",
+      "why": "direct"
+    },
+    {
+      "answer": "Hooks and the statusline run again for each subagent.",
+      "why": "reverse"
+    }
+  ],
+  "fail": [
+    {
+      "answer": "Ten subagents three deep is a lot of processes.",
+      "why": "no fan-out"
+    }
+  ]
+}
diff --git a/plugins/harness-ops/evals/ap-fanout-version-and-kthreads/samples/version-fixes-slowdowns.json b/plugins/harness-ops/evals/ap-fanout-version-and-kthreads/samples/version-fixes-slowdowns.json
new file mode 100644
index 00000000000..ccf5d35e067
--- /dev/null
+++ b/plugins/harness-ops/evals/ap-fanout-version-and-kthreads/samples/version-fixes-slowdowns.json
@@ -0,0 +1,18 @@
+{
+  "pass": [
+    {
+      "answer": "Yes. Several 2.1.2xx releases fixed long-session slowdowns and keystroke lag.",
+      "why": "releases fixed"
+    },
+    {
+      "answer": "Fixes for CPU regressions landed in later releases.",
+      "why": "reverse"
+    }
+  ],
+  "fail": [
+    {
+      "answer": "The version is unlikely to matter.",
+      "why": "wrong"
+    }
+  ]
+}
diff --git a/plugins/harness-ops/evals/asv-absent-key-subagent-use-counts/case.yaml b/plugins/harness-ops/evals/asv-absent-key-subagent-use-counts/case.yaml
new file mode 100644
index 00000000000..5956aba4e45
--- /dev/null
+++ b/plugins/harness-ops/evals/asv-absent-key-subagent-use-counts/case.yaml
@@ -0,0 +1,18 @@
+schema_version: "1.1"
+name: asv-absent-key-subagent-use-counts
+graders:
+  - name: absent-key-not-loaded
+    type: regex
+    pattern: 'defaultEnabled[^\n]{0,200}\b(?:not|never|ignored|no effect|doesn[’'']?t|does not)\b|\b(?:not|never|doesn[’'']?t|does not)\b[^\n]{0,80}defaultEnabled|\b(?:will be|is|stays|shows as|reads|reported as|counts as|treated as) (?:disabled|hidden|off)\b'
+    flags: 'i'
+    target: last_message
+  - name: subagent-own-window
+    type: regex
+    pattern: 'sub-?agent[^\n]{0,250}\b(?:own (?:context )?window|smaller (?:context )?window|shed\w*|(?:truncated?|truncates|truncation|truncating)|cut short|drop\w*|not (?:covered|guaranteed)|doesn[’'']?t (?:cover|carry|apply)|does not (?:cover|carry|apply))|\bmain session\b[^\n]{0,120}\bonly\b|\bonly\b[^\n]{0,60}\bmain session\b'
+    flags: 'i'
+    target: last_message
+  - name: use-count-not-comparable
+    type: regex
+    pattern: '\bhooks?\b[^\n]{0,250}\b(?:count\w*|dispatch\w*|inflat\w*|dominat\w*|fires?|fired|every)\b|\bnot (?:directly )?comparable\b|\bincomparable\b'
+    flags: 'i'
+    target: last_message
diff --git a/plugins/harness-ops/evals/asv-absent-key-subagent-use-counts/prompt.md b/plugins/harness-ops/evals/asv-absent-key-subagent-use-counts/prompt.md
new file mode 100644
index 00000000000..3598d4f45f5
--- /dev/null
+++ b/plugins/harness-ops/evals/asv-absent-key-subagent-use-counts/prompt.md
@@ -0,0 +1,14 @@
+---
+description: "Three questions audit-skill-visibility answers from its text: an installed plugin with `defaultEnabled: true` and no `enabledPlugins` key (it does not load; the runtime reading beats the docs), whether a fitting listing holds in subagents (a subagent's listing is sized to its own window and can shed), and whether a raw plugin use count ranks usage (hooks and other dispatches count, so hook-heavy plugins dominate). Reaches SKILL.md (verification records, subagent sentence) and reference/usage-counters.md. Source: the consumer's own writing. hard: the docs say defaultEnabled decides an absent key. Read-only tools. Held-rows rows: harness-ops 34, 38, 45."
+tags: [harness-ops, audit-skill-visibility, reference-answer, hard]
+max_turns: 20
+timeout_seconds: 400
+allowed_tools: [Skill, Read, Glob, Grep]
+expected_outcome: "The answer says notes-kit's skills do not load (defaultEnabled does not decide an absent key at runtime), that the fit verdict covers the main session and a subagent's listing is sized to its own window and can shed, and that plugin use counts include hook and other dispatches so they are not comparable across plugin shapes."
+---
+
+/harness-ops:audit-skill-visibility no need to run the full audit, I just have three questions:
+
+1. Our `notes-kit` plugin is installed, its marketplace entry sets `defaultEnabled: true`, and no settings file has an `enabledPlugins` entry for it. Will its skills show up?
+2. Your last run said my skill listing fits. Does that hold for subagents too?
+3. `~/.claude.json` shows `guardrails` with about 200,000 uses and `notes-kit` with 150. Is guardrails really the plugin I use most?
diff --git a/plugins/harness-ops/evals/asv-absent-key-subagent-use-counts/samples/absent-key-not-loaded.json b/plugins/harness-ops/evals/asv-absent-key-subagent-use-counts/samples/absent-key-not-loaded.json
new file mode 100644
index 00000000000..fe642e60ff7
--- /dev/null
+++ b/plugins/harness-ops/evals/asv-absent-key-subagent-use-counts/samples/absent-key-not-loaded.json
@@ -0,0 +1,18 @@
+{
+  "pass": [
+    {
+      "answer": "No. `defaultEnabled` does not decide an absent key at runtime, so notes-kit is disabled.",
+      "why": "direct"
+    },
+    {
+      "answer": "Its skills won't load: the plugin is treated as disabled with no enabledPlugins entry.",
+      "why": "treated as disabled"
+    }
+  ],
+  "fail": [
+    {
+      "answer": "Yes, defaultEnabled: true turns it on.",
+      "why": "wrong"
+    }
+  ]
+}
diff --git a/plugins/harness-ops/evals/asv-absent-key-subagent-use-counts/samples/subagent-own-window.json b/plugins/harness-ops/evals/asv-absent-key-subagent-use-counts/samples/subagent-own-window.json
new file mode 100644
index 00000000000..85c3976e1b0
--- /dev/null
+++ b/plugins/harness-ops/evals/asv-absent-key-subagent-use-counts/samples/subagent-own-window.json
@@ -0,0 +1,18 @@
+{
+  "pass": [
+    {
+      "answer": "Not necessarily. A subagent gets a listing sized to its own window and can shed skills.",
+      "why": "own window"
+    },
+    {
+      "answer": "The verdict covers only the main session.",
+      "why": "only main"
+    }
+  ],
+  "fail": [
+    {
+      "answer": "Yes, subagents see the same listing.",
+      "why": "wrong"
+    }
+  ]
+}
diff --git a/plugins/harness-ops/evals/asv-absent-key-subagent-use-counts/samples/use-count-not-comparable.json b/plugins/harness-ops/evals/asv-absent-key-subagent-use-counts/samples/use-count-not-comparable.json
new file mode 100644
index 00000000000..a6ee64218d0
--- /dev/null
+++ b/plugins/harness-ops/evals/asv-absent-key-subagent-use-counts/samples/use-count-not-comparable.json
@@ -0,0 +1,18 @@
+{
+  "pass": [
+    {
+      "answer": "No. Every hook dispatch counts as a use, so hook-only plugins dominate.",
+      "why": "hooks count"
+    },
+    {
+      "answer": "Those numbers are not comparable across plugin shapes.",
+      "why": "not comparable"
+    }
+  ],
+  "fail": [
+    {
+      "answer": "Yes, guardrails is your most used plugin.",
+      "why": "wrong"
+    }
+  ]
+}
diff --git a/plugins/harness-ops/evals/cl-drift-dedupe-sees-closed/case.yaml b/plugins/harness-ops/evals/cl-drift-dedupe-sees-closed/case.yaml
new file mode 100644
index 00000000000..8498cc6db92
--- /dev/null
+++ b/plugins/harness-ops/evals/cl-drift-dedupe-sees-closed/case.yaml
@@ -0,0 +1,13 @@
+schema_version: "1.1"
+name: cl-drift-dedupe-sees-closed
+graders:
+  - name: dedupe-includes-closed
+    type: regex
+    pattern: '--state all\b|\ball states\b|(?:^|[.!?;](?=\s|$))(?!(?:(?![.!?;](?:\s|$))[^\n])*?(?:\b(?:not|no|never|cannot|misses|missed)\b|n[’'']t\b|\bonly (?:open|lists? open|sees? open)))(?:(?![.!?;](?:\s|$))[^\n])*?(?:\b(?:includes?|including|included|covers?|sees?|finds?|searches|lists?)\b(?:(?![.!?;](?:\s|$))[^\n]){0,40}?\bclosed\b|\bclosed\b(?:(?![.!?;](?:\s|$))[^\n]){0,40}?\b(?:too|as well|included)\b)'
+    flags: 'im'
+    target: last_message
+  - name: raises-limit
+    type: regex
+    pattern: '--limit 1000\b|\b1,?000\b|\blimit\b[^.\n]{0,40}\braised\b|\b30\b[^.\n]{0,60}\bdefault|\bdefault\b[^.\n]{0,60}\b30\b'
+    flags: 'i'
+    target: last_message
diff --git a/plugins/harness-ops/evals/cl-drift-dedupe-sees-closed/prompt.md b/plugins/harness-ops/evals/cl-drift-dedupe-sees-closed/prompt.md
new file mode 100644
index 00000000000..479f9e7b5c5
--- /dev/null
+++ b/plugins/harness-ops/evals/cl-drift-dedupe-sees-closed/prompt.md
@@ -0,0 +1,10 @@
+---
+description: "One question about the changelog skill's native-drift step: its duplicate check lists issues in every state with a raised limit (`gh issue list --state all --limit 1000`), so a closed match is found even with 200 open issues. Reaches context/native-drift.md (dedupe step and its recorded fact). Source: the consumer's own writing. routine. Needs --allow-tools Bash for the pre-computed line. Held-rows rows: harness-ops 50."
+tags: [harness-ops, changelog, reference-answer, routine]
+max_turns: 15
+timeout_seconds: 300
+allowed_tools: [Skill, Read, Glob, Grep, Bash]
+expected_outcome: "No apply runs. The answer says the check lists issues in all states (closed included) with a 1000 limit, above the 30 default, so the closed issue is found."
+---
+
+/harness-ops:changelog quick question about the native-drift step in apply: before it files an item it checks for an existing one. We closed a matching issue last month and have about 200 open issues. Will that check find the closed one? Answer only, don't run apply.
diff --git a/plugins/harness-ops/evals/cl-drift-dedupe-sees-closed/samples/dedupe-includes-closed.json b/plugins/harness-ops/evals/cl-drift-dedupe-sees-closed/samples/dedupe-includes-closed.json
new file mode 100644
index 00000000000..cf724235f94
--- /dev/null
+++ b/plugins/harness-ops/evals/cl-drift-dedupe-sees-closed/samples/dedupe-includes-closed.json
@@ -0,0 +1,34 @@
+{
+  "pass": [
+    {
+      "answer": "Yes, it runs `gh issue list --state all --limit 1000`, so the closed issue is found and no duplicate is filed.",
+      "why": "flag with later no"
+    },
+    {
+      "answer": "Yes: per `context/native-drift.md`, the check runs `gh issue list --state all --limit 1000`.",
+      "why": "filename dot"
+    },
+    {
+      "answer": "Yes. It runs `gh issue list --state all`, so closed issues are included.",
+      "why": "flag"
+    },
+    {
+      "answer": "Yes, the search covers closed issues as well.",
+      "why": "prose"
+    }
+  ],
+  "fail": [
+    {
+      "answer": "No, it only sees open issues.",
+      "why": "wrong"
+    },
+    {
+      "answer": "No, it won't find the closed one.",
+      "why": "negated find"
+    },
+    {
+      "answer": "It lists only open issues, so the closed one is missed.",
+      "why": "only open"
+    }
+  ]
+}
diff --git a/plugins/harness-ops/evals/cl-drift-dedupe-sees-closed/samples/raises-limit.json b/plugins/harness-ops/evals/cl-drift-dedupe-sees-closed/samples/raises-limit.json
new file mode 100644
index 00000000000..800c6744515
--- /dev/null
+++ b/plugins/harness-ops/evals/cl-drift-dedupe-sees-closed/samples/raises-limit.json
@@ -0,0 +1,18 @@
+{
+  "pass": [
+    {
+      "answer": "It passes `--limit 1000`, so 200 open issues do not crowd it out.",
+      "why": "limit"
+    },
+    {
+      "answer": "The default of 30 would miss it, which is why the limit is raised.",
+      "why": "default 30"
+    }
+  ],
+  "fail": [
+    {
+      "answer": "Yes, it searches closed issues.",
+      "why": "no limit"
+    }
+  ]
+}
diff --git a/plugins/harness-ops/evals/cl-one-cluster-stays-inline/case.yaml b/plugins/harness-ops/evals/cl-one-cluster-stays-inline/case.yaml
new file mode 100644
index 00000000000..b394d2b3f9e
--- /dev/null
+++ b/plugins/harness-ops/evals/cl-one-cluster-stays-inline/case.yaml
@@ -0,0 +1,21 @@
+schema_version: "1.1"
+name: cl-one-cluster-stays-inline
+context:
+  scaffold_script: scaffold.sh
+graders:
+  - name: ran-status-on-range
+    type: tool_used
+    tool: 'Bash'
+    input_match: '"command":"(?:[^"\\]|\\.)*?changelog-status\.sh(?:[^"\\]|\\.)*?--range'
+    min: 1
+  - name: stays-inline
+    type: tool_used
+    tool: 'Agent'
+    input_match: '"description":"(?![^"]*[Vv]erif)'
+    min: 0
+    max: 0
+  - name: row-for-notes-skill
+    type: regex
+    pattern: 'skills/notes/SKILL\.md'
+    flags: 'i'
+    target: last_message
diff --git a/plugins/harness-ops/evals/cl-one-cluster-stays-inline/prompt.md b/plugins/harness-ops/evals/cl-one-cluster-stays-inline/prompt.md
new file mode 100644
index 00000000000..89cfc9aed67
--- /dev/null
+++ b/plugins/harness-ops/evals/cl-one-cluster-stays-inline/prompt.md
@@ -0,0 +1,12 @@
+---
+description: "A two-release diff with three items, one a behavioral change the scaffolded skill states, so Phase 1 explores and Phase 2 research is reached. One release cluster and one feature cluster: explore and research stay in this session; only the local verifier may run as a subagent. Reaches SKILL.md 'Phase 1. Explore', 'Phase 2. Research' step 1 and context/decisions.md 'Fan-out shape'. Source: the consumer's own writing (a small release). routine: on Opus 5.5 the current text already kept explore and research in-session. Needs --scaffold --allow-tools Bash (Agent granted for the no-spawn grader). Held-rows rows: harness-ops 48, 49."
+tags: [harness-ops, changelog, delegation, no-network, routine]
+max_turns: 40
+timeout_seconds: 900
+allowed_tools: [Skill, Read, Glob, Grep, Bash, Agent]
+expected_outcome: "The skill runs changelog-status.sh on v2.1.260..v2.1.261 with the local changelog, explores and researches the three items in this session without spawning an explorer or researcher (the local verifier may run), and emits a correct row for skills/notes/SKILL.md (its 80% compaction claim)."
+---
+
+/harness-ops:changelog diff v2.1.260..v2.1.261
+
+This machine has no network. A complete copy of the changelog is at ./changelog.md; use it instead of fetching.
diff --git a/plugins/harness-ops/evals/cl-one-cluster-stays-inline/samples/ran-status-on-range.json b/plugins/harness-ops/evals/cl-one-cluster-stays-inline/samples/ran-status-on-range.json
new file mode 100644
index 00000000000..b361998b1d8
--- /dev/null
+++ b/plugins/harness-ops/evals/cl-one-cluster-stays-inline/samples/ran-status-on-range.json
@@ -0,0 +1,30 @@
+{
+  "pass": [
+    {
+      "answer": [
+        {
+          "tool": "Bash",
+          "input": {
+            "command": "bash /p/skills/changelog/scripts/changelog-status.sh --changelog ./changelog.md --range v2.1.260..v2.1.261",
+            "description": "status"
+          }
+        }
+      ],
+      "why": "range"
+    }
+  ],
+  "fail": [
+    {
+      "answer": [
+        {
+          "tool": "Bash",
+          "input": {
+            "command": "bash /p/skills/changelog/scripts/changelog-status.sh --no-fetch",
+            "description": "status"
+          }
+        }
+      ],
+      "why": "no range"
+    }
+  ]
+}
diff --git a/plugins/harness-ops/evals/cl-one-cluster-stays-inline/samples/row-for-notes-skill.json b/plugins/harness-ops/evals/cl-one-cluster-stays-inline/samples/row-for-notes-skill.json
new file mode 100644
index 00000000000..19c4f88343a
--- /dev/null
+++ b/plugins/harness-ops/evals/cl-one-cluster-stays-inline/samples/row-for-notes-skill.json
@@ -0,0 +1,22 @@
+{
+  "pass": [
+    {
+      "answer": "| skills/notes/SKILL.md | correct | The compaction default is now 90%, not 80%. |",
+      "why": "row"
+    },
+    {
+      "answer": "Owner surface `skills/notes/SKILL.md`: correct the 80% claim.",
+      "why": "prose"
+    }
+  ],
+  "fail": [
+    {
+      "answer": "No item in range touches this repository.",
+      "why": "no row"
+    },
+    {
+      "answer": "The notes skill states 80%; correct it.",
+      "why": "no path"
+    }
+  ]
+}
diff --git a/plugins/harness-ops/evals/cl-one-cluster-stays-inline/samples/stays-inline.json b/plugins/harness-ops/evals/cl-one-cluster-stays-inline/samples/stays-inline.json
new file mode 100644
index 00000000000..dfa4bf4e6be
--- /dev/null
+++ b/plugins/harness-ops/evals/cl-one-cluster-stays-inline/samples/stays-inline.json
@@ -0,0 +1,49 @@
+{
+  "pass": [
+    {
+      "answer": [],
+      "why": "no call"
+    },
+    {
+      "answer": [
+        {
+          "tool": "Agent",
+          "input": {
+            "description": "Verify repo-side row facts",
+            "prompt": "check paths",
+            "subagent_type": "Explore"
+          }
+        }
+      ],
+      "why": "local verifier only"
+    }
+  ],
+  "fail": [
+    {
+      "answer": [
+        {
+          "tool": "Agent",
+          "input": {
+            "description": "Explore 2.1.260-261",
+            "prompt": "grep surfaces",
+            "subagent_type": "Explore"
+          }
+        }
+      ],
+      "why": "explorer"
+    },
+    {
+      "answer": [
+        {
+          "tool": "Agent",
+          "input": {
+            "description": "Research compaction",
+            "prompt": "docs",
+            "subagent_type": "claude-code-guide"
+          }
+        }
+      ],
+      "why": "researcher"
+    }
+  ]
+}
diff --git a/plugins/harness-ops/evals/cl-one-cluster-stays-inline/scaffold.sh b/plugins/harness-ops/evals/cl-one-cluster-stays-inline/scaffold.sh
new file mode 100755
index 00000000000..33dacae8459
--- /dev/null
+++ b/plugins/harness-ops/evals/cl-one-cluster-stays-inline/scaffold.sh
@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+# A small plugin whose skill states a default, and a two-release changelog that changes it.
+set -euo pipefail
+mkdir -p .claude-plugin skills/notes
+printf '{"name":"notes-kit","version":"1.0.0","description":"Session notes"}\n' >.claude-plugin/plugin.json
+cat >skills/notes/SKILL.md <<'EOF'
+---
+description: Save session notes before the conversation is compacted.
+---
+
+# Notes
+
+Compaction starts when the conversation reaches 80% of the context window (the
+`autoCompactWindow` default), so write the notes file before then.
+EOF
+cat >changelog.md <<'EOF'
+# Claude Code changelog
+
+<Update label="2.1.261" description="November 2, 2026">
+* Changed the `autoCompactWindow` default from 80% to 90% of the context window
+* Fixed a crash when a hook printed invalid UTF-8
+</Update>
+
+<Update label="2.1.260" description="November 1, 2026">
+* Added a `--tail` flag to `claude agents`
+</Update>
+EOF
diff --git a/plugins/harness-ops/evals/la-compaction-resume-and-cloud/case.yaml b/plugins/harness-ops/evals/la-compaction-resume-and-cloud/case.yaml
new file mode 100644
index 00000000000..df148767a93
--- /dev/null
+++ b/plugins/harness-ops/evals/la-compaction-resume-and-cloud/case.yaml
@@ -0,0 +1,24 @@
+schema_version: "1.1"
+name: la-compaction-resume-and-cloud
+graders:
+  - name: compaction-not-reset
+    type: regex
+    pattern: 'compact\w*[^\n]{0,250}\b(?:not a (?:fresh |true |real |clean )?(?:reset|context|start)|isn[’'']?t a (?:fresh |true |real |clean )?(?:reset|context|start)|lossy|(?:summary|summaries|summari[sz]\w*))|\b(?:lossy|(?:summary|summaries|summari[sz]\w*))[^\n]{0,200}compact'
+    flags: 'i'
+    target: last_message
+  - name: declines-resume-bg
+    type: regex
+    pattern: '(?:\bno\b|don[’'']?t|do not|never|avoid|shouldn[’'']?t|should not|\bnot\b)[^.\n]{0,100}--resume|--resume[^\n]{0,200}\b(?:instead|rather|fresh|declin\w*|not a restart|isn[’'']?t a restart)'
+    flags: 'i'
+    target: last_message
+  - name: cloud-not-listed
+    type: regex
+    pattern: '(?:does not|doesn[’'']?t|won[’'']?t|will not|\bnot\b|never)[^.\n]{0,40}\b(?:list|show|include|see|report)\w*\b[^.\n]{0,60}\bcloud|\bcloud\b[^.\n]{0,100}\b(?:not (?:listed|shown|included|visible)|aren[’'']?t (?:listed|shown|included)|invisible|missing)|\bnot (?:the )?cloud sessions?\b|\b(?:only (?:lists?|shows?)|lists? only|shows? only)\b[^.\n]{0,60}\b(?:this|your|the local|local)\b[^.\n]{0,20}\b(?:machine|computer|sessions)\b'
+    flags: 'i'
+    target: last_message
+  - name: git-gather-separate
+    type: tool_used
+    tool: 'Bash'
+    input_match: '"command":"(?=(?:[^"\\]|\\.)*\bgit\b)(?:[^"\\]|\\.)*?(?:&&|;|\|\|)'
+    min: 0
+    max: 0
diff --git a/plugins/harness-ops/evals/la-compaction-resume-and-cloud/prompt.md b/plugins/harness-ops/evals/la-compaction-resume-and-cloud/prompt.md
new file mode 100644
index 00000000000..ba2f7f12040
--- /dev/null
+++ b/plugins/harness-ops/evals/la-compaction-resume-and-cloud/prompt.md
@@ -0,0 +1,16 @@
+---
+description: "Three questions the lanes skill answers before any lane runs: auto-compaction is a lossy summary, not a reset; a lane is never restarted with `claude --resume <id> --bg`; `claude agents --json` does not list cloud sessions. Any git gather call stays a separate Bash call. Reaches SKILL.md (repository context, 'A relaunch is the only context reset', Gotchas, verified CLI surface) and context/config.md. Source: the consumer's own writing. routine. Needs --allow-tools Bash for the pre-computed lines. Held-rows rows: harness-ops 64, 66, 71, 74."
+tags: [harness-ops, lanes, reference-answer, routine]
+max_turns: 20
+timeout_seconds: 400
+allowed_tools: [Skill, Read, Glob, Grep, Bash]
+expected_outcome: "Nothing starts or stops. The answer says auto-compaction summarizes older history and is not a fresh context, declines `--resume ... --bg` as a restart (restart launches a fresh session from the prompt file), and says cloud sessions do not show in `claude agents --json`."
+---
+
+/harness-ops:lanes three questions before I set up a lane on this box:
+
+1. If a lane runs for a week, does auto-compaction give it a fresh context, so I can skip restarts?
+2. Can I restart a lane by resuming its session with `claude --resume <session-id> --bg`?
+3. If I run a lane in the cloud, will `claude agents --json` show it?
+
+Answer only, don't start or stop anything.
diff --git a/plugins/harness-ops/evals/la-compaction-resume-and-cloud/samples/cloud-not-listed.json b/plugins/harness-ops/evals/la-compaction-resume-and-cloud/samples/cloud-not-listed.json
new file mode 100644
index 00000000000..3c0aec04148
--- /dev/null
+++ b/plugins/harness-ops/evals/la-compaction-resume-and-cloud/samples/cloud-not-listed.json
@@ -0,0 +1,26 @@
+{
+  "pass": [
+    {
+      "answer": "No. `claude agents --json` only lists sessions running on this machine, not cloud sessions.",
+      "why": "only this machine"
+    },
+    {
+      "answer": "No. That command lists only sessions on this machine.",
+      "why": "lists only"
+    },
+    {
+      "answer": "No. `claude agents --json` does not list cloud sessions.",
+      "why": "direct"
+    },
+    {
+      "answer": "Cloud lanes are not listed there; the launcher keeps a marker.",
+      "why": "cloud first"
+    }
+  ],
+  "fail": [
+    {
+      "answer": "Yes, it shows cloud lanes too.",
+      "why": "wrong"
+    }
+  ]
+}
diff --git a/plugins/harness-ops/evals/la-compaction-resume-and-cloud/samples/compaction-not-reset.json b/plugins/harness-ops/evals/la-compaction-resume-and-cloud/samples/compaction-not-reset.json
new file mode 100644
index 00000000000..58487fa509e
--- /dev/null
+++ b/plugins/harness-ops/evals/la-compaction-resume-and-cloud/samples/compaction-not-reset.json
@@ -0,0 +1,18 @@
+{
+  "pass": [
+    {
+      "answer": "No. Auto-compaction summarizes older history in place; it is not a reset.",
+      "why": "summary"
+    },
+    {
+      "answer": "Compaction isn't a fresh context, so keep restarts.",
+      "why": "isn't fresh"
+    }
+  ],
+  "fail": [
+    {
+      "answer": "Yes, compaction gives it a fresh context.",
+      "why": "wrong"
+    }
+  ]
+}
diff --git a/plugins/harness-ops/evals/la-compaction-resume-and-cloud/samples/declines-resume-bg.json b/plugins/harness-ops/evals/la-compaction-resume-and-cloud/samples/declines-resume-bg.json
new file mode 100644
index 00000000000..dc23c276c86
--- /dev/null
+++ b/plugins/harness-ops/evals/la-compaction-resume-and-cloud/samples/declines-resume-bg.json
@@ -0,0 +1,18 @@
+{
+  "pass": [
+    {
+      "answer": "No, do not use `claude --resume <id> --bg`; restart launches a fresh session.",
+      "why": "decline"
+    },
+    {
+      "answer": "`--resume` continues the old transcript; use restart instead.",
+      "why": "instead"
+    }
+  ],
+  "fail": [
+    {
+      "answer": "Yes, that resumes the lane.",
+      "why": "wrong"
+    }
+  ]
+}
diff --git a/plugins/harness-ops/evals/la-compaction-resume-and-cloud/samples/git-gather-separate.json b/plugins/harness-ops/evals/la-compaction-resume-and-cloud/samples/git-gather-separate.json
new file mode 100644
index 00000000000..64414fa6b0b
--- /dev/null
+++ b/plugins/harness-ops/evals/la-compaction-resume-and-cloud/samples/git-gather-separate.json
@@ -0,0 +1,34 @@
+{
+  "pass": [
+    {
+      "answer": [
+        {
+          "tool": "Bash",
+          "input": {
+            "command": "git rev-parse --show-toplevel",
+            "description": "root"
+          }
+        }
+      ],
+      "why": "single"
+    },
+    {
+      "answer": [],
+      "why": "no call"
+    }
+  ],
+  "fail": [
+    {
+      "answer": [
+        {
+          "tool": "Bash",
+          "input": {
+            "command": "git remote get-url origin && git rev-parse --show-toplevel",
+            "description": "gather"
+          }
+        }
+      ],
+      "why": "chained"
+    }
+  ]
+}
diff --git a/plugins/harness-ops/evals/ob-cost-and-flag-verify/case.yaml b/plugins/harness-ops/evals/ob-cost-and-flag-verify/case.yaml
new file mode 100644
index 00000000000..367b7183acc
--- /dev/null
+++ b/plugins/harness-ops/evals/ob-cost-and-flag-verify/case.yaml
@@ -0,0 +1,19 @@
+schema_version: "1.1"
+name: ob-cost-and-flag-verify
+graders:
+  - name: cost-is-list-estimate
+    type: regex
+    pattern: '\blist[- ]?(?:rate|price|pric\w*)\b|\bestimat\w*\b[^.\n]{0,80}\bnot\b[^.\n]{0,30}\bbill|\bnot (?:a|your|the) bill\b|\bnot what you(?:[’'']ll| will| are)? (?:be )?(?:billed|charged|pay)'
+    flags: 'i'
+    target: last_message
+  - name: no-posttooluse-claim
+    type: regex
+    pattern: '\bcli-flag-verify\b(?:(?![.!?;](?:\s|$))[^\n]){0,200}?(?<!not a )(?<!not an )(?<!not as a )(?<!longer a )(?<!longer an )(?<!n''t a )(?<!n’t a )(?<! run as a )(?<!than a )(?<!than as a )(?<!stead of a )(?<!not )(?<!never )(?<!no )(?<!No )\bPostToolUse\b|(?<!not a )(?<!not an )(?<!not as a )(?<!longer a )(?<!longer an )(?<!n''t a )(?<!n’t a )(?<! run as a )(?<!than a )(?<!than as a )(?<!stead of a )(?<!not )(?<!never )(?<!no )(?<!No )\bPostToolUse\b(?:(?![.!?;](?:\s|$))[^\n]){0,200}?\bcli-flag-verify\b'
+    flags: 'im'
+    match: not_contains
+    target: last_message
+  - name: names-push-time
+    type: regex
+    pattern: '\bpush(?:-time| time)\b|\bpre-push\b|\bat push\b|\bon (?:git )?push\b|\breference-verify\b'
+    flags: 'i'
+    target: last_message
diff --git a/plugins/harness-ops/evals/ob-cost-and-flag-verify/prompt.md b/plugins/harness-ops/evals/ob-cost-and-flag-verify/prompt.md
new file mode 100644
index 00000000000..19fd754292c
--- /dev/null
+++ b/plugins/harness-ops/evals/ob-cost-and-flag-verify/prompt.md
@@ -0,0 +1,13 @@
+---
+description: "Two questions the observability skill answers: whether the report's dollar figure is the subscription bill (a list-rate estimate), and where cli-flag-verify catches show and when that check runs (guardrails runs it at push time in the reference-verify git hook, so no PostToolUse event carries it). Reaches SKILL.md, context/output-format.md and context/data-sources.md 4.5. Source: the consumer's own writing. hard: the pre-fix text described cli-flag-verify as a PostToolUse hook, and a question-only run reaches for plugin-directory Grep the sandbox denies (its pilot runs were INVALID). Needs --allow-tools Bash for the pre-computed lines. Held-rows rows: harness-ops 84, 90."
+tags: [harness-ops, observability, reference-answer, hard]
+max_turns: 20
+timeout_seconds: 400
+allowed_tools: [Skill, Read, Glob, Grep, Bash]
+expected_outcome: "The answer says the dollar figure is a list-rate estimate, not the bill, and that cli-flag-verify runs at push time in guardrails' reference-verify git hook rather than as a PostToolUse hook after each edit."
+---
+
+/harness-ops:observability two questions, no report needed:
+
+1. Last week's report showed $41.20. Is that what I'm billed on my Max subscription?
+2. Where would I see the cli-flag-verify catches from guardrails, and when does that check run?
diff --git a/plugins/harness-ops/evals/ob-cost-and-flag-verify/samples/cost-is-list-estimate.json b/plugins/harness-ops/evals/ob-cost-and-flag-verify/samples/cost-is-list-estimate.json
new file mode 100644
index 00000000000..f379165034c
--- /dev/null
+++ b/plugins/harness-ops/evals/ob-cost-and-flag-verify/samples/cost-is-list-estimate.json
@@ -0,0 +1,18 @@
+{
+  "pass": [
+    {
+      "answer": "No. It's a list-rate estimate, not a bill.",
+      "why": "list rate"
+    },
+    {
+      "answer": "That figure is an estimate and not your bill.",
+      "why": "estimate"
+    }
+  ],
+  "fail": [
+    {
+      "answer": "Yes, $41.20 is your charge for the week.",
+      "why": "wrong"
+    }
+  ]
+}
diff --git a/plugins/harness-ops/evals/ob-cost-and-flag-verify/samples/names-push-time.json b/plugins/harness-ops/evals/ob-cost-and-flag-verify/samples/names-push-time.json
new file mode 100644
index 00000000000..25f3b504c1c
--- /dev/null
+++ b/plugins/harness-ops/evals/ob-cost-and-flag-verify/samples/names-push-time.json
@@ -0,0 +1,18 @@
+{
+  "pass": [
+    {
+      "answer": "It runs at push time in the `reference-verify` git hook.",
+      "why": "push time"
+    },
+    {
+      "answer": "A pre-push entry runs it.",
+      "why": "pre-push"
+    }
+  ],
+  "fail": [
+    {
+      "answer": "It runs after every Write or Edit.",
+      "why": "stale"
+    }
+  ]
+}
diff --git a/plugins/harness-ops/evals/ob-cost-and-flag-verify/samples/no-posttooluse-claim.json b/plugins/harness-ops/evals/ob-cost-and-flag-verify/samples/no-posttooluse-claim.json
new file mode 100644
index 00000000000..8197c3aad1c
--- /dev/null
+++ b/plugins/harness-ops/evals/ob-cost-and-flag-verify/samples/no-posttooluse-claim.json
@@ -0,0 +1,42 @@
+{
+  "pass": [
+    {
+      "answer": "cli-flag-verify runs at push time in guardrails' reference-verify git hook rather than as a PostToolUse hook after each edit.",
+      "why": "expected outcome"
+    },
+    {
+      "answer": "cli-flag-verify doesn't run as a PostToolUse hook anymore.",
+      "why": "doesn't"
+    },
+    {
+      "answer": "It is no longer a PostToolUse hook: cli-flag-verify moved to push time.",
+      "why": "no longer"
+    },
+    {
+      "answer": "The cli-flag-verify check is not a PostToolUse hook anymore.",
+      "why": "not a"
+    }
+  ],
+  "fail": [
+    {
+      "answer": "cli-flag-verify runs as a PostToolUse hook after each edit, so the report does not show its catches.",
+      "why": "negation elsewhere"
+    },
+    {
+      "answer": "Per data-sources.md, cli-flag-verify is a PostToolUse hook.",
+      "why": "filename dot"
+    },
+    {
+      "answer": "cli-flag-verify is a PostToolUse hook; it never runs at push time.",
+      "why": "semicolon clause"
+    },
+    {
+      "answer": "The cli-flag-verify PostToolUse hook fires after each Write or Edit.",
+      "why": "stale"
+    },
+    {
+      "answer": "Look for PostToolUse events from cli-flag-verify in the hook log.",
+      "why": "stale reverse"
+    }
+  ]
+}
diff --git a/plugins/harness-ops/evals/pl-install-summary-and-rollback-lines/case.yaml b/plugins/harness-ops/evals/pl-install-summary-and-rollback-lines/case.yaml
new file mode 100644
index 00000000000..341dcf84acc
--- /dev/null
+++ b/plugins/harness-ops/evals/pl-install-summary-and-rollback-lines/case.yaml
@@ -0,0 +1,18 @@
+schema_version: "1.1"
+name: pl-install-summary-and-rollback-lines
+graders:
+  - name: no-reload-after-active
+    type: regex
+    pattern: 'reload(?:-plugins)?\b[^.\n]{0,80}\b(?:not (?:needed|required|necessary)|unnecessary)|(?:don[’'']?t|do not|doesn[’'']?t|does not|no) (?:need|have) to (?:run )?(?:a )?/?reload|\balready (?:active|live|loaded)\b|\bno reload\b'
+    flags: 'i'
+    target: last_message
+  - name: calls-it-downgrade
+    type: regex
+    pattern: '\b(?:downgrad\w*|roll(?:ed)?[- ]?back|rollback)\b'
+    flags: 'i'
+    target: last_message
+  - name: explains-head-only-compare
+    type: regex
+    pattern: '\bshallow\b|\bre-?clon\w*|\bat (?:the )?(?:clone[’'']?s )?HEAD\b|\bHEAD commit\b|\b(?:latest|newest|tip|current) commit\b[^.\n]{0,120}\bolder commit\b|\bolder commit\b[^.\n]{0,160}\b(?:nothing|no object|not (?:there|held|present)|missing)'
+    flags: 'i'
+    target: last_message
diff --git a/plugins/harness-ops/evals/pl-install-summary-and-rollback-lines/prompt.md b/plugins/harness-ops/evals/pl-install-summary-and-rollback-lines/prompt.md
new file mode 100644
index 00000000000..2b3f5d96039
--- /dev/null
+++ b/plugins/harness-ops/evals/pl-install-summary-and-rollback-lines/prompt.md
@@ -0,0 +1,14 @@
+---
+description: "Three questions about lines the plugins skill reads: the `/plugin` install summary's `Plugin is now active.` (no reload needed), an `updated from 3.4.0 to 3.3.1` sync line (a downgrade, reported under Downgraded), and why the cache-content check skips most installs (only installs recorded at the shallow marketplace clone's HEAD are compared). Reaches context/scope-semantics.md (install summary, cache content) and context/sync.md (downgrade guard). Source: the consumer's own writing. routine. Read-only tools. Held-rows rows: harness-ops 110, 113, 120."
+tags: [harness-ops, plugins, reference-answer, routine]
+max_turns: 20
+timeout_seconds: 400
+allowed_tools: [Skill, Read, Glob, Grep]
+expected_outcome: "No sync runs. The answer says no reload is needed after `Plugin is now active.`, calls the 3.4.0-to-3.3.1 line a downgrade, and explains that only installs recorded at the marketplace clone's HEAD are compared because the clone is shallow and re-cloned on update."
+---
+
+/harness-ops:plugins quick questions, no sync please:
+
+1. I installed a plugin from the in-session /plugin menu and the summary ended with `Plugin is now active.` Do I still need to run /reload-plugins?
+2. Last sync, one line read `updated from 3.4.0 to 3.3.1` for `linter@acme`. Is that a normal update?
+3. The cache-content check said most of my installs were not compared. Why would it skip them?
diff --git a/plugins/harness-ops/evals/pl-install-summary-and-rollback-lines/samples/calls-it-downgrade.json b/plugins/harness-ops/evals/pl-install-summary-and-rollback-lines/samples/calls-it-downgrade.json
new file mode 100644
index 00000000000..bc900d22f5f
--- /dev/null
+++ b/plugins/harness-ops/evals/pl-install-summary-and-rollback-lines/samples/calls-it-downgrade.json
@@ -0,0 +1,18 @@
+{
+  "pass": [
+    {
+      "answer": "No, 3.4.0 to 3.3.1 is a downgrade; sync lists it under Downgraded.",
+      "why": "downgrade"
+    },
+    {
+      "answer": "That line is a rollback the CLI still words as an update.",
+      "why": "rollback"
+    }
+  ],
+  "fail": [
+    {
+      "answer": "Yes, a normal update.",
+      "why": "wrong"
+    }
+  ]
+}
diff --git a/plugins/harness-ops/evals/pl-install-summary-and-rollback-lines/samples/explains-head-only-compare.json b/plugins/harness-ops/evals/pl-install-summary-and-rollback-lines/samples/explains-head-only-compare.json
new file mode 100644
index 00000000000..9423303e43c
--- /dev/null
+++ b/plugins/harness-ops/evals/pl-install-summary-and-rollback-lines/samples/explains-head-only-compare.json
@@ -0,0 +1,22 @@
+{
+  "pass": [
+    {
+      "answer": "Only installs recorded at the clone's HEAD are compared; the marketplace clone is shallow.",
+      "why": "both"
+    },
+    {
+      "answer": "Claude Code re-clones the marketplace on update, so older commits are gone.",
+      "why": "re-clone"
+    },
+    {
+      "answer": "It only compares installs recorded at the latest commit of the marketplace's local copy, so an install recorded at an older commit has nothing to compare against.",
+      "why": "latest vs older commit"
+    }
+  ],
+  "fail": [
+    {
+      "answer": "It skips installs it could not read.",
+      "why": "wrong cause"
+    }
+  ]
+}
diff --git a/plugins/harness-ops/evals/pl-install-summary-and-rollback-lines/samples/no-reload-after-active.json b/plugins/harness-ops/evals/pl-install-summary-and-rollback-lines/samples/no-reload-after-active.json
new file mode 100644
index 00000000000..62d9f1e31f3
--- /dev/null
+++ b/plugins/harness-ops/evals/pl-install-summary-and-rollback-lines/samples/no-reload-after-active.json
@@ -0,0 +1,22 @@
+{
+  "pass": [
+    {
+      "answer": "1. No. `Plugin is now active.` means it is already live; no reload.",
+      "why": "already live"
+    },
+    {
+      "answer": "You don't need to run /reload-plugins after that line.",
+      "why": "don't need"
+    }
+  ],
+  "fail": [
+    {
+      "answer": "Yes, run /reload-plugins to load it.",
+      "why": "wrong"
+    },
+    {
+      "answer": "Run /reload-plugins --force to be safe.",
+      "why": "force"
+    }
+  ]
+}
diff --git a/plugins/harness-ops/evals/pl-list-version-and-orphan-records/case.yaml b/plugins/harness-ops/evals/pl-list-version-and-orphan-records/case.yaml
new file mode 100644
index 00000000000..f129ad4b125
--- /dev/null
+++ b/plugins/harness-ops/evals/pl-list-version-and-orphan-records/case.yaml
@@ -0,0 +1,17 @@
+schema_version: "1.1"
+name: pl-list-version-and-orphan-records
+graders:
+  - name: list-is-not-loaded-version
+    type: regex
+    pattern: '\b(?:not|isn[’'']?t|doesn[’'']?t|does not|never|no)\b[^.\n]{0,80}\b(?:loaded|loads?|running|in effect|effective|what(?:[’'']s| is) (?:loaded|running))\b|\bproject[- ]scope\b[^.\n]{0,100}\b(?:wins|takes precedence|is what (?:loads|runs))'
+    flags: 'i'
+    target: last_message
+  - name: prune-is-dependency-axis
+    type: regex
+    pattern: '\bprune\b[^\n]{0,200}\bdependenc|\bdependenc[^\n]{0,200}\bprune\b'
+    flags: 'i'
+    target: last_message
+  - name: names-prune-version-floor
+    type: regex
+    pattern: '2\.1\.121\b'
+    target: last_message
diff --git a/plugins/harness-ops/evals/pl-list-version-and-orphan-records/prompt.md b/plugins/harness-ops/evals/pl-list-version-and-orphan-records/prompt.md
new file mode 100644
index 00000000000..eb2147347da
--- /dev/null
+++ b/plugins/harness-ops/evals/pl-list-version-and-orphan-records/prompt.md
@@ -0,0 +1,15 @@
+---
+description: "Two questions the plugins skill answers from its context files: whether `claude plugin prune -s project` reaps records a deleted worktree stranded (it is a dependency axis, and needs Claude Code 2.1.121), and whether `claude plugin list`'s version is the one loaded here (on 2.1.322 it prints one row per install record with its own scope and version, and never says which row loads here). Reaches context/scope-semantics.md ('plugin list / plugin details version output is misleading', the prune and --force gates) and context/stale-records-cache-content.md. Source: the consumer's own writing. hard: the model's prior reads `plugin list` as the loaded version and `prune` as a cleanup verb. Read-only tools. Held-rows rows: harness-ops 107, 108, 115."
+tags: [harness-ops, plugins, reference-answer, hard]
+max_turns: 20
+timeout_seconds: 400
+allowed_tools: [Skill, Read, Glob, Grep]
+expected_outcome: "No sync runs. The answer says prune acts on auto-installed dependencies and cannot reap the stranded records, notes prune needs Claude Code 2.1.121 or later (the laptop is on 2.1.110), and says the version `plugin list` reports is not what this repository loads (the project-scope install decides)."
+---
+
+/harness-ops:plugins before I touch anything, two things on my laptop (it runs Claude Code 2.1.110):
+
+1. I deleted a scratch worktree that had three project-scope plugin installs, and `claude plugin list` still shows them. Can I clear those leftover records with `claude plugin prune -s project`?
+2. `claude plugin list` reports `formatter@acme` at 4.2.0, but this repo's project scope is on 4.1.0. Is 4.2.0 what's loaded when I work in this repo?
+
+Just answer, don't run a sync.
diff --git a/plugins/harness-ops/evals/pl-list-version-and-orphan-records/samples/list-is-not-loaded-version.json b/plugins/harness-ops/evals/pl-list-version-and-orphan-records/samples/list-is-not-loaded-version.json
new file mode 100644
index 00000000000..44ebb4f3abb
--- /dev/null
+++ b/plugins/harness-ops/evals/pl-list-version-and-orphan-records/samples/list-is-not-loaded-version.json
@@ -0,0 +1,22 @@
+{
+  "pass": [
+    {
+      "answer": "No. `plugin list` output is not what's loaded here; the project-scope 4.1.0 wins in this repo.",
+      "why": "direct"
+    },
+    {
+      "answer": "4.2.0 isn't necessarily the version running in this repo.",
+      "why": "isn't running"
+    },
+    {
+      "answer": "**2. No, 4.2.0 is not what loads in this repo; 4.1.0 is.**",
+      "why": "not what loads"
+    }
+  ],
+  "fail": [
+    {
+      "answer": "Yes, 4.2.0 is what this repo uses.",
+      "why": "wrong"
+    }
+  ]
+}
diff --git a/plugins/harness-ops/evals/pl-list-version-and-orphan-records/samples/names-prune-version-floor.json b/plugins/harness-ops/evals/pl-list-version-and-orphan-records/samples/names-prune-version-floor.json
new file mode 100644
index 00000000000..3b2f9aeee2e
--- /dev/null
+++ b/plugins/harness-ops/evals/pl-list-version-and-orphan-records/samples/names-prune-version-floor.json
@@ -0,0 +1,18 @@
+{
+  "pass": [
+    {
+      "answer": "Also, `prune` needs Claude Code 2.1.121 or later; 2.1.110 is below it.",
+      "why": "floor"
+    }
+  ],
+  "fail": [
+    {
+      "answer": "Your version is fine for prune.",
+      "why": "no floor"
+    },
+    {
+      "answer": "prune needs 2.1.163.",
+      "why": "wrong floor"
+    }
+  ]
+}
diff --git a/plugins/harness-ops/evals/pl-list-version-and-orphan-records/samples/prune-is-dependency-axis.json b/plugins/harness-ops/evals/pl-list-version-and-orphan-records/samples/prune-is-dependency-axis.json
new file mode 100644
index 00000000000..809e484a469
--- /dev/null
+++ b/plugins/harness-ops/evals/pl-list-version-and-orphan-records/samples/prune-is-dependency-axis.json
@@ -0,0 +1,22 @@
+{
+  "pass": [
+    {
+      "answer": "No: `prune` removes auto-installed dependencies, not records by path.",
+      "why": "dependency axis"
+    },
+    {
+      "answer": "That command works on dependencies only; prune has no path flag.",
+      "why": "reverse order"
+    }
+  ],
+  "fail": [
+    {
+      "answer": "Yes, `claude plugin prune -s project` clears them.",
+      "why": "wrong"
+    },
+    {
+      "answer": "Prune cannot reach them; nothing in the CLI reaps by path.",
+      "why": "no dependency reason"
+    }
+  ]
+}
diff --git a/plugins/harness-ops/skills/audit-skill-visibility/reference/usage-counters.md b/plugins/harness-ops/skills/audit-skill-visibility/reference/usage-counters.md
index 6252de0beda..ece6b0982ef 100644
--- a/plugins/harness-ops/skills/audit-skill-visibility/reference/usage-counters.md
+++ b/plugins/harness-ops/skills/audit-skill-visibility/reference/usage-counters.md
@@ -8,15 +8,14 @@ file, a different file from `~/.claude/settings.json`.
 Companion: [listing-scorer.md](listing-scorer.md), which covers how the product
 ranks these counts when it truncates the skill listing.
 
-## Verification stamp
+## Binary reading behind this file
 
-Follows `docs/contracts/upstream-drift`.
+Follows `docs/contracts/upstream-drift`. No docs page defines these counters, so every
+region below, the plugin-use definition included, rests on one binary reading: string
+extraction of `claude.exe` at Claude Code 2.1.251 (the write and read functions named per
+region, confirmed against a live `~/.claude.json`; scorer and truncator unchanged at 2.1.252),
+as of 2026-08-31.
 
-- **Claim:** the write paths, seeding behavior, and per-region semantics below.
-- **Basis:** string extraction of `claude.exe` at Claude Code 2.1.251, the write
-  and read functions named per region, confirmed against a live `~/.claude.json`.
-  Scorer and truncator re-verified unchanged at 2.1.252.
-- **As-of:** 2026-08-31.
 - **Locate by shape, never by name.** Minified identifiers move between builds;
   the listing scorer was `zPe` at 2.1.251 and `WPe` at 2.1.252 with an identical
   body. Grep the arithmetic and the field names, not the function names.
@@ -73,8 +72,8 @@ zero-count plugin's `lastUsedAt` is the seed time and means nothing. Measured on
 one machine: 46 of 65 plugins looked "used today" while none had been used. That
 measurement is what `is_usage_evidence()` in the engine exists to enforce.
 
-**A plugin "use" is broad and not comparable across plugin shapes.** Usage is
-recorded whenever a slash command, skill, agent, MCP tool or resource, or hook is
+**A plugin "use" is broad and not comparable across plugin shapes.** In the
+binary reading above, usage is recorded whenever a slash command, skill, agent, MCP tool or resource, or hook is
 dispatched from that plugin, plus LSP servers delivering diagnostics or code
 navigation. Hook-only plugins therefore dominate any raw ranking: on one machine
 `guardrails` showed 200,804 and `context-guard` 106,752, against low hundreds for
@@ -113,9 +112,7 @@ question needs the plugin's own `skill-usage.jsonl` store, whose rows carry
 
 The file is never swept: `cleanupPeriodDays` does not reach it, because it lives
 in the home directory rather than under `~/.claude`. The supported lever is
-`claude purge <path>`, which removes one project's entry. Every running
-session polls the file at 1 Hz, and the strongest public report of curing input
-lag pruned this file rather than the install tree.
+`claude purge <path>`, which removes one project's entry.
 
 - **Pointer:** [claude-directory: cleaned up automatically](https://code.claude.com/docs/en/claude-directory#cleaned-up-automatically)
   lists the paths the retention sweep deletes, all under `~/.claude/`, and does not
diff --git a/plugins/harness-ops/skills/lanes/context/config.md b/plugins/harness-ops/skills/lanes/context/config.md
index 494796272e6..64065440b0c 100644
--- a/plugins/harness-ops/skills/lanes/context/config.md
+++ b/plugins/harness-ops/skills/lanes/context/config.md
@@ -123,8 +123,9 @@ marketplace repository; this section covers only what the launcher does.
   has changes, the lane's telemetry cannot be read (no numeric `telemetry.issue`, or a
   `telemetry.repo` other than origin's), or the lane requests the lane-stop gate. A not-yet-honored
   `execution_target_fallback` from an authorized author in the lane's telemetry moves one launch to
-  today's launch. `claude agents --json` does not list cloud sessions, so the
-  launcher writes `<data-dir>/lanes/<repo-key>/<name>-cloud-launch`: `start` skips a lane while it
+  today's launch. `claude agents --json` lists the sessions on this machine
+  ([List sessions as JSON](https://code.claude.com/docs/en/agent-view#list-sessions-as-json)), not
+  cloud sessions, so the launcher writes `<data-dir>/lanes/<repo-key>/<name>-cloud-launch`: `start` skips a lane while it
   stands, and `restart` sends a new session (archive the earlier one at claude.ai).
 - **`cloud-routine`, `cloud-project`.** Setup steps are printed and nothing launches; `restart`
   leaves a running local session of the lane up. A lane whose stage may read untrusted input gets no
@@ -165,7 +166,8 @@ prompt file is not snapshotted: each run still reads it from the checkout's prom
 lane can rewrite its next scheduled prompt, but that prompt runs under the same pinned permission
 mode the lane already has, so the rewrite gives it no privilege it lacks. Calling a short
 script keeps the Windows `/TR` payload to `"<bash>" "<script>"`; a lane whose payload would pass
-schtasks' 262-character limit is refused, so pass a shorter `--data-dir`. A scheduled
+the `/tr` length limit (the `/tr` row at the pointer below) is refused, so pass a shorter
+`--data-dir`. A scheduled
 lane's name must be letters, digits, `.`, `_` or `-`, because it names the script and the task.
 Registering an entry is the operator's step. Run the `schtasks` lines from cmd.exe, as
 [restart-consumer.md](restart-consumer.md) explains for its own entries.
diff --git a/plugins/harness-ops/skills/observability/context/data-sources.md b/plugins/harness-ops/skills/observability/context/data-sources.md
index cddaa936d9d..5fe1597d4a8 100644
--- a/plugins/harness-ops/skills/observability/context/data-sources.md
+++ b/plugins/harness-ops/skills/observability/context/data-sources.md
@@ -9,7 +9,7 @@
 - [2.6 Toggles and retention in effect](#26-toggles-and-retention-in-effect)
 - [3. Tool call decisions: which calls were denied, and why](#3-tool-call-decisions-which-calls-were-denied-and-why)
 - [4. Recurring tool-call patterns](#4-recurring-tool-call-patterns)
-- [4.5 Hallucination-guard catches (`cli-flag-verify` violations)](#45-hallucination-guard-catches-cli-flag-verify-violations)
+- [4.5 Hallucination-guard catches (`cli-flag-verify`)](#45-hallucination-guard-catches-cli-flag-verify)
 - [5. Drift candidates (rules-vs-code mismatches)](#5-drift-candidates-rules-vs-code-mismatches)
 - [6. Calibration signal: dismissed observations](#6-calibration-signal-dismissed-observations)
 - [7. Git + GH activity (context for severity)](#7-git--gh-activity-context-for-severity)
@@ -360,42 +360,15 @@ jq -s 'map(select(.hook != null)) | sort_by(.ts) as $e
 ' "${HOOK_FILES[@]}"
 ```
 
-## 4.5 Hallucination-guard catches (`cli-flag-verify` violations)
+## 4.5 Hallucination-guard catches (`cli-flag-verify`)
 
-`cli-flag-verify` PostToolUse hook (advisory exit 1) emits one `PostToolUse` event per unverifiable `<bin> --<flag>` pair detected in a Write/Edit, discriminated from other `PostToolUse` writers via the `hook` field. Subject format: `<bin>:<sha16>`, with bin in clear (groupable) and sha16 = first 16 hex of `sha256("<bin> <flag>")` (flag content protected). Schema: whatever envelope the consumer's hook emitter writes; the fields used here are `hook` and `subject`. Per-period count + per-binary breakdown calibrates the verifier (false-positive rate, hallucination hot-spots) and gates the future advisory→blocking exit-2 graduation.
-
-**Per-period count + per-binary breakdown:**
-
-```bash
-jq -s --arg since "$SINCE_ISO" '
-  map(select(.hook_event_name == "PostToolUse" and .hook == "cli-flag-verify" and .ts >= $since))
-  | { total: length,
-      unique_pairs: (map(.subject) | unique | length),
-      by_binary: (group_by(.subject | split(":")[0])
-                  | map({ bin: .[0].subject | split(":")[0],
-                          count: length,
-                          unique: (map(.subject) | unique | length) })
-                  | sort_by(-.count)) }
-' "${HOOK_FILES[@]}"
-```
-
-**Top recurring hallucinations** (same `<bin>:<sha16>` repeating = same flag re-hallucinated):
-
-```bash
-jq -s --arg since "$SINCE_ISO" '
-  map(select(.hook_event_name == "PostToolUse" and .hook == "cli-flag-verify" and .ts >= $since) | .subject)
-  | group_by(.) | map({ subject: .[0], count: length })
-  | sort_by(-.count) | .[0:10]
-' "${HOOK_FILES[@]}"
-```
-
-**Flag rules:**
-
-- HIGH: same `<bin>:<sha16>` appearing 3+ times (recurring agent confusion, an escalation candidate for blocking exit 2 once FP rate < 1%)
-- MEDIUM: per-binary count > 5 in window (binary's `--help` may be non-exhaustive, a candidate for the guardrails `cli_flag_verify_skip_bins` option)
-- INFO: total count, unique-pair count, per-binary distribution
-
-Empty: `"no cli-flag-verify violations: verifier may be advisory-clean OR the consumer's telemetry sink is not wired/enabled"`.
+guardrails runs `cli-flag-verify` at push time, in its `reference-verify` git hook, not after each
+Write or Edit: the `reference-verify` entry is a `pre-push` hook whose assets carry
+`hooks/cli-flag-verify.sh` (`plugins/guardrails/git-hooks/entries.json:43-52`), and
+`plugins/guardrails/hooks/hooks.json` registers no `cli-flag-verify` hook. A git hook writes no
+Claude Code hook event, so the hook event log holds no catches to count. Report the section as
+`not collected: cli-flag-verify runs at push time in guardrails' reference-verify git hook`, and
+never read an empty count as a clean verifier.
 
 ## 5. Drift candidates (rules-vs-code mismatches)
 
diff --git a/plugins/harness-ops/skills/observability/context/output-format.md b/plugins/harness-ops/skills/observability/context/output-format.md
index 720078f6772..9b02002c837 100644
--- a/plugins/harness-ops/skills/observability/context/output-format.md
+++ b/plugins/harness-ops/skills/observability/context/output-format.md
@@ -77,19 +77,8 @@ Failed-then-fixed retries:
 
 ## Hallucination-guard catches
 
-`PostToolUse` events from `cli-flag-verify` hook (advisory exit 1).
-
-- Total: `<N>` violations · unique `<bin>:<sha16>` pairs: `<U>`
-
-| Binary | Catches | Unique pairs | Severity |
-|---|---:|---:|---|
-| claude | 12 | 4 | MEDIUM |
-| gh | 3 | 3 | INFO |
-
-Top recurring (same `<bin>:<sha16>` ≥ 3×):
-
-- `5× claude:<sha16>`: repeated hallucination, escalation candidate
-- (or) `_no recurrences_`
+`not collected: cli-flag-verify runs at push time in guardrails' reference-verify git hook`
+(data-sources.md 4.5).
 
 ## Drift candidates
 
diff --git a/plugins/harness-ops/skills/plugins/context/scope-semantics.md b/plugins/harness-ops/skills/plugins/context/scope-semantics.md
index e5cc07521d0..e5897ab4ad1 100644
--- a/plugins/harness-ops/skills/plugins/context/scope-semantics.md
+++ b/plugins/harness-ops/skills/plugins/context/scope-semantics.md
@@ -83,12 +83,20 @@ A raw count of `divergences[].length` conflates the two and overstates drift. Al
 
 ## `plugin list` / `plugin details` version output is misleading
 
-**Verified misleading**: `claude plugin list` and `claude plugin details <name>` show the *highest
-installed version across all scopes*, not the version actually loaded for the current working
-directory. Never treat their output as "what's running here." Derive effective-version claims from
+**Neither output says what loads here.** `claude plugin list` prints one row per install record,
+each with its own scope and version, and its text form does not name the project a `project` row
+belongs to or mark the row that applies to the current directory: one plugin showed four rows
+(`project` 8.12.26, `user` 8.12.26, `project` 8.11.0, `project` 8.10.0), three of them project
+records for different checkouts. `claude plugin details <name>` prints a single version with no
+scope. Never treat either output as "what's running here." Derive effective-version claims from
 `fleet-state.sh`'s scope-by-cwd resolution (via `currentProject` + scope precedence) or a functional
 probe, never from `list`/`details` text.
 
+- **Recorded output**: `claude plugin list` and `claude plugin list --help` on Claude Code 2.1.322,
+  read 2026-11-11 (`--help` names no scope or project filter).
+- **Recheck trigger**: a release note that changes `claude plugin list` or `claude plugin details`
+  output, or adds a scope or project column to the text form.
+
 ## `plugin update -s project` does NOT write committed settings
 
 **Empirically verified** (hash-compared a real repo's `.claude/settings.json` and
@@ -366,11 +374,11 @@ As of: 2026-11-04. Recheck trigger: that section stops saying monitors require a
 
 **An install can now activate itself, but not the installs this skill issues.** An install started
 from the in-session `/plugin` interface reports its activation state, and this skill reads two
-lines of that summary: `Plugin is now active.` means the plugin is live with no reload, and
-`Run /reload-plugins to apply.` means a reload is needed. What the interface does after that line,
-including when it leaves the plugin pending, is read at the pointer below. The release that made
-`/plugin` installs activate when safe is the
-[2.1.221 changelog entry](https://code.claude.com/docs/en/changelog#2-1-221).
+lines of that summary: `Plugin is now active.` and `Run /reload-plugins to apply.`. What the
+interface does after each line, including whether it reloads on its own or leaves the plugin
+pending, is read at the pointer below; the releases that changed it are
+[2.1.221](https://code.claude.com/docs/en/changelog#2-1-221) and
+[2.1.268](https://code.claude.com/docs/en/changelog#2-1-268).
 
 This does **not** relax the reload guidance below, because `sync` installs through the shell
 command, not the interface, and we treat a shell install as loading only at the next start or the
@@ -384,9 +392,6 @@ for below.
   [Install a plugin](https://code.claude.com/docs/en/plugins/install#install-a-plugin); for shell
   installs, see
   [Install from your shell](https://code.claude.com/docs/en/plugins/install#install-from-your-shell).
-- **As of**: 2026-10-11
-- **Recheck trigger**: either summary line changes, a shell install starts activating in an open
-  session, or a later changelog entry changes when a `/plugin` install activates.
 
 `--force` is real (Claude Code ≥ 2.1.163). We treat it as the answer to one warning only: the
 reload declining a change to the session's MCP or LSP tools because of the prompt cache. Which
@@ -394,8 +399,8 @@ changes raise that warning is read at the pointer below, not predicted here.
 
 So follow this two-step rather than predicting the cause:
 
-1. Check the install summary: if it reports `Run /reload-plugins to apply.` and the plugin is
-   still not active, run `/reload-plugins`.
+1. Check the install summary and, at the pointer above, what the panel already did after it; only
+   if the plugin is still not active, run bare `/reload-plugins`.
 2. If that warns that the reload will re-read the conversation, rerun it as
    `/reload-plugins --force`.
 
@@ -540,11 +545,9 @@ state from a healthy one. It reports and never repairs; see
 [stale-records-cache-content.md](stale-records-cache-content.md).
 
 **A marketplace clone has been observed shallow, so most installs are not checked most of the time.** The clone
-under `installLocation` carried a `.git/shallow` file when this was measured, and Claude Code
-re-clones the marketplace on update (see
-[Host and maintain a marketplace](https://code.claude.com/docs/en/plugins/host-marketplace.md); read
-2026-10-25; the page states the re-clone and says nothing about shallowness or clone depth, so the
-shallow shape is our observation, not the page's). An install recorded at an older commit usually
+under `installLocation` carried a `.git/shallow` file when this was measured (our observation; the
+docs say nothing about clone depth), and an update replaces the clone rather than deepening it (see
+[What background auto-update does with credentials](https://code.claude.com/docs/en/plugins/host-marketplace#what-background-auto-update-does-with-credentials)). An install recorded at an older commit usually
 has no object in the clone to compare against, so the check compares only installs recorded at the
 clone's HEAD and reports the rest as `not-at-head`, counted `not checked (recorded at an older
 commit)` rather than unverifiable, on a fleet with nothing wrong with it. Observed 2026-10-04
diff --git a/plugins/harness-ops/skills/plugins/context/stale-records-cache-content.md b/plugins/harness-ops/skills/plugins/context/stale-records-cache-content.md
index 9c464c31913..99dcf5f2e90 100644
--- a/plugins/harness-ops/skills/plugins/context/stale-records-cache-content.md
+++ b/plugins/harness-ops/skills/plugins/context/stale-records-cache-content.md
@@ -120,10 +120,9 @@ does not perform, some hosts refuse a fetch by sha, and it would also silently e
 the verdict exists to report.
 
 **Only an install recorded at the clone's HEAD is compared.** The marketplace clone is observed to
-be shallow, and Claude Code re-clones it on update
-([host-marketplace](https://code.claude.com/docs/en/plugins/host-marketplace.md), as of 2026-10-25;
-the page states the re-clone, not shallowness or a depth; recheck when its update or clone
-description changes). So an install recorded at an older commit usually has no object in the clone
+be shallow, and an update replaces it rather than deepening it
+([What background auto-update does with credentials](https://code.claude.com/docs/en/plugins/host-marketplace#what-background-auto-update-does-with-credentials);
+shallowness is our observation, not the page's). So an install recorded at an older commit usually has no object in the clone
 to compare against. The checker therefore compares only records whose `gitCommitSha` is the
 clone's HEAD and gives every other record the `not-at-head` verdict, counted in `not_checked`. A
 deeper clone that does hold the older commit gets the same answer, so the report does not depend