v0.5.8 — four green lights that could not have gone red

Four green lights that could not have gone red.

The largest group below shares a shape rather than a subject: a reading was trusted for an answer it was structurally incapable of giving.

• install.mjs --check called a Codex entry clean by parsing a line on which every value is printed *****.
• The MCP Registry badge read servers[0] off an endpoint that returns every version ever published under a name, oldest first — so it printed a version that got staler with each release.
• The link-closure gate this project added one release ago printed CLEAN over the densest batch of relative links in the repository, because one regex read left to right can only ever see the inner half of a nested badge.
• openai/codex#28912 closing as completed was quoted in the place a reader looks to find out whether a failure still bites — the closure of an umbrella, which cannot speak for any single failure filed beneath it.

None of the four was a wrong number waiting to be corrected. Each was an instrument reporting on itself while wearing the clothes of a report about the world.

Added

• The engine's first MCP prompt, get_started. The README used to open by asking new users to type a sentence; that sentence is now an entry in the host's own menu. Its body is an instruction to the AI — look at what you already have, check the App Store, read get_app_guide before writing anything — not a copy of the authoring guide, and a test fails if any line of it starts appearing verbatim in the guide.

Removed

• The OMA_DYNAMIC_TOOLS=1 the installer wrote into host entries since 2026-07-28. It existed because a chat-surface regression swallowed the loader widget's boot call and open_app hung at "Loading app…"; it cost one approval prompt per app. Re-measured 2026-08-16 on Claude Desktop 1.30096.5: a registration without the flag renders through the universal open_app, clicks write, and the data survives a restart. Re-running the installer removes the key from your host entries — and only that key.

Fixed

• --check reported a Codex entry as clean while it carried the retired key, because it parsed output where every env value is masked. It now reads the value where the value exists, and reports stale when it cannot read it at all rather than assuming the best. The same commit closes a defect of the same family: re-registering a stale Codex entry used to send an add with no env, which silently dropped a user's other variables.
• Every visitor to the npm package page was served the Chinese README. npm force-packs every README* in the package root and picked the second one. The fix is not to guess npm's rule but to leave exactly one README* at the root; the Chinese one now lives in i18n/.
• KNOWN-ISSUES.md pointed at a closed umbrella issue in the place a reader looks to learn whether a failure still bites. It now names the open bug, and says what the closed one was.
• The Host support table gave one row to a product with two surfaces. Claude Code in a terminal has no widget surface; Claude Code inside the Claude app does, and renders through the universal open_app (measured 2026-08-16). The section on the screen beside a terminal now leads with its cheapest form — a browser pane in the same tiled workspace, same machine, no tunnel.
• Six passages a stranger trips over that a reader inside this repository completes from memory, plus three comments in shipped files that had stopped being true — including src/http.mjs's claim that binding to loopback "costs nothing", which stopped being true the day @live shipped: /mcp pays nothing for it, /view pays a bridge you stand up yourself.

Verified before publishing: the snapshot's own bytes ran through the public CI steps in Linux containers on node:22 and node:24 — 1616 assertions, zero failures, no MCP host present. The published v0.5.7 was run through the same container for comparison (1567), so the delta is a reading, not an inference.

Full detail: CHANGELOG.md