v0.55.2

Fixed

• Upgrading from 0.55.1 or earlier: install with npm i -g, not flair upgrade. (#1834)

  Heads-up: upgrading from 0.55.1 or earlier, run npm i -g @tpsdev-ai/flair@0.55.2, then flair restart, then flair doctor --fix; the new code then refreshes the pins and changes only the pin.
  If you already ran flair upgrade to reach 0.55.2, check FLAIR_AGENT_ID in each MCP client config (for example ~/.claude.json and ~/.codex/config.toml) and in your SessionStart hook commands, and restore any that changed. 0.55.2 cannot recover a value an earlier refresh already overwrote.

• Codex's ~/.codex/config.toml writers are now one locked, atomic critical section. (#1778)

• Every flair hook config write is now one locked, identity-checked critical section, so two Flair writers can no longer lose an edit. (#1778)

• The four flair doctor hook-file writers now share the same locked critical section, so every writer of the hook settings file is race-free. (#1778)

• The hook writers never lower a pin, repair a continuity command without unpinning it, and decide on every pi source at once. (#1346, #1778)

• Every writer of the four JSON client-MCP config files is now one locked, identity-checked critical section — and flair init no longer writes ~/.claude.json itself. (#1778)

• pi's settings.json writers are now one locked, atomic critical section — the last client-config sink (Refs #1778). (#1778)

• The direct client writers never lower a pin, never overwrite a range/tag/unsupported spec, and refuse to write when the CLI cannot read its own version. (#1778)

  Heads-up: a run whose own version cannot be read now refuses to write
  rather than falling back to the unpinned spec. An unreadable version means
  a broken install, and quietly replacing a pin with nothing is the downgrade
  this change exists to stop. The same refusal also declines a legitimate
  FIRST install on a fresh home — nothing is created — until the version can
  be read again.

• Wiring specs that are a range, tag or unsupported source are no longer read as absent (and overwritten); they are held as present-but-not-comparable. (#1778)

• flair init: an ops-API agent-seed timeout now names the operation, target and timeout, and retries once. (#1790)

• flair init's ops-API seed no longer retries away a real error when a non-OK response's body read stalls. (#1790)

• migrations: a failed state.json write is now logged and surfaced in /HealthDetail. (#1800)

• The CLI-build test helper can no longer hang a hook: it builds once, bounded and SIGKILLed (flair#1807). (#1807)

  Heads-up: in CI nothing changes (both lanes pre-build); on a dev box the
  build runs at most once per test process and a hung one is now named.

• The macOS launchd adopt repair now waits for the started process before judging it, instead of failing on one early observation. (#1827)

  Heads-up: on macOS, flair doctor --fix can now take up to the startup
  budget when adopting an instance into launchd — it waits for the process to
  serve rather than failing fast on a slow start.

• A Codex TOML pin refresh no longer rewrites a line that sits inside a multiline string. (#1834)

• A Codex TOML pin refresh now changes only the pinned package span, and flair doctor --fix re-pins a behind Codex block again. (#1834)

• A Codex TOML pin refresh no longer mistakes a sibling [mcp_servers.flair*] table for the Flair section. (#1834)

• flair doctor now checks a wired Claude Code SessionStart hook whatever Claude Code's install state. (#1834)

• flair doctor now checks a wired Codex SessionStart hook whatever Codex's install state. (#1834)

• SessionStart hook re-pins hand the never-lower guard the exact span they rewrite, not the whole command. (#1834)

• A stale hook pinned with both a pre-release and a build suffix is re-pinned, not held. (#1834)

• A SessionStart hook is now re-pinned only when its full command is one of the exact installer forms; every other shape is held, not rewritten. (#1834)

• A Flair SessionStart hook re-pin no longer reports success when its write was refused. (#1834)

• A pin refresh now changes only the pinned package argument, never a wired client's agent identity. (#1834)

  Heads-up: a release that installs this fix runs the PREVIOUS version's
  refresh one last time when upgraded with flair upgrade. Prefer
  npm i -g @tpsdev-ai/flair@<version>, then flair restart, then
  flair doctor --fix. Identities already corrupted by the old refresh cannot
  be recovered.

• A pin refresh no longer reports a missing client directory as a failure, and duplicate-key detection compares decoded key names. (#1834)

• The federation sync cursor advances on a legacy hub row, and a field-only write can no longer revert a key repair or revocation. (#1835)

  Heads-up: a legacy spoke whose hub row has an empty publicKey no longer
  warns every poll — its cursor advances again. The missing key itself is not
  repaired here; re-pair the hub to restore it. connected means recent
  contact, not a verified identity or pull readiness.

• The .bak backup now writes every byte and never leaks its staging temp. (#1778)

• flair-client: signing operations now refuse to run without an explicit agent identity. (#1816)

  Heads-up: scripted writes that relied on the default identity now fail
  closed — set FLAIR_AGENT_ID or pass --agent <id> at those call sites.

• flair doctor --fix --dry-run now prints MCP re-pin lines in the real run's format. (#1834)

• flair doctor --fix now re-pins a behind MCP-client block, not just the SessionStart hook, through the one shared writer. (#1485, #1779, #1778)

• The SessionStart hook re-pin substitutes only the captured version span. (#1834)

• A pin refresh whose write is refused now reports a failure, never a false success. (#1834)

  Heads-up: nothing to do. A refresh that cannot complete its write is
  now loud instead of silently claiming the new pin.

• The canary now emits a sha256-bound promote block for every lockstep package, so latest no longer skews on release. (#1383, #1781, #1686)

• The canary verdict script runs on stock macOS bash and treats an unreadable release manifest as fatal. (#1781)

• The ADK auto-promote delimiter table gains the CJK angle and hollow-bracket pairs. (#1776)

• The ADK auto-promote structural-truncation check now covers the enumerated full-width and CJK bracket pairs. (#1756, #1775, #1776)

  Heads-up: this detects STRUCTURAL truncation, not semantic completeness.
  A claim can be perfectly balanced and still be a fragment; passing the check
  says only that no imbalance was detected in the enumerated pairs, never that
  a promoted claim is complete.

• ADK auto-promote refuses a structurally truncated claim instead of persisting a fragment. (#1776, #1756, #1775)

  Heads-up: this detects STRUCTURAL truncation, not semantic completeness.
  A claim can be perfectly balanced and still be a fragment; a refusal here
  says only that the text is structurally lopsided, never that a promoted
  claim is complete.

• REM distillation no longer passes off a truncated source or a length-capped response as a complete claim. (#1756)

• flair upgrade no longer proposes or performs a downgrade when the installed version is ahead of registry latest. (#1778)

• The pin refresh fails closed on a pin it cannot compare, and flair doctor reports an unparseable pin instead of calling it stale. (#1778)

• flair upgrade and flair doctor no longer misreport an install ahead of, or unparseable against, the published version. (#1778)

Security

• A <path>.bak planted as a symlink is now replaced, not written through. (#1778)

• The <path>.bak hook-config backup is now written 0600, never the umask default. (#1778)

---

Full record: CHANGELOG.md