v1.9.18 — v1.11.0 bundle + cli#188 pin + andon-cure (first npm release)

Patch release — first npm release carrying bassclef substrate v1.11.0 + cli#188 dynamic substrate pin + cli#439 dev-repo version file + andon-cure.

Why v1.9.18 (not v1.9.17)

v1.9.17 was tagged + GitHub-released on 2026-10-18 (commit 4af3b11) but never reached npm. The publish workflow (run 39084375792) failed at the andon scan step on you@example.com in the bundled onboard-repo SKILL body. PR #442 (SHA 2b5d1658) cured the andon trip with one per-file FILE_ALLOWLIST entry + ADR-004 §Ordered steps check 9 amendment. v1.9.18 bundles the v1.9.17 content plus that cure.

Three closures from v1.9.17 (shipping now via v1.9.18)

• cli#188 (structural root) — .bassclef-pin at repo root replaces 3 hardcoded v1.X.Y sites in .github/workflows/publish.yml. Sync PR advances one file instead of three YAML sites. Drift class closes at the mechanism.
• cli#438 (drift at root) — pin bumped v1.8.0 → v1.11.0. First release bundling actual current substrate since 2026-10-07.
• cli#439 (dev-repo surface) — bassclef-version.json at bassclef-cli root; statusline reads local file first.

Three adopter cures ride in from bassclef v1.11.0

• /onboard-repo preflight cluster (upstream#2248) — closes 6 cold-adopter friction tickets (upstream#2232-#2237).
• New .claude/hooks/pre-push-shellcheck.sh (upstream#2108) — PreToolUse Bash matcher on git push.
• lib/tier-dependency-audit.sh walk_graph_bfs_inbound rewritten O(N × M) → O(N + M).

Test matrix

• vitest 525/525 PASS (was 523; +2 new andon T13a/T13b)
• typecheck clean
• install harness 11 PASS / 1 skip
• CI: pr-checks + ADR-059 + docker-smoke all GREEN
• Local pack+andon: clean, exit 0

Related

• Closes cli#188, cli#438, cli#439 (via PR #440 content)
• Supersedes v1.9.17 (tagged but never shipped)
• Also filed this session: cli#441 (bump-version postcondition bug)

Full changelog: https://github.com/sunj-labs/bassclef-cli/blob/main/CHANGELOG.md