chore(sync): cascade fleet template@5f12bba

Author: jdalton

.gitattributes

@@ -11,6 +11,7 @@
 .claude/commands/security-scan.md linguist-generated=true
 .claude/commands/setup-security-tools.md linguist-generated=true
 .claude/commands/squash-history.md linguist-generated=true
+.claude/commands/update-coverage.md linguist-generated=true
 .claude/commands/update-security.md linguist-generated=true
 .claude/hooks/_shared/README.md linguist-generated=true
 .claude/hooks/_shared/acorn/README.md linguist-generated=true
@@ -343,6 +344,11 @@
 .claude/hooks/socket-token-minifier-start/index.mts linguist-generated=true
 .claude/hooks/socket-token-minifier-start/package.json linguist-generated=true
 .claude/hooks/socket-token-minifier-start/tsconfig.json linguist-generated=true
+.claude/hooks/squash-history-reminder/README.md linguist-generated=true
+.claude/hooks/squash-history-reminder/index.mts linguist-generated=true
+.claude/hooks/squash-history-reminder/package.json linguist-generated=true
+.claude/hooks/squash-history-reminder/test/index.test.mts linguist-generated=true
+.claude/hooks/squash-history-reminder/tsconfig.json linguist-generated=true
 .claude/hooks/stale-process-sweeper/README.md linguist-generated=true
 .claude/hooks/stale-process-sweeper/index.mts linguist-generated=true
 .claude/hooks/stale-process-sweeper/package.json linguist-generated=true
@@ -426,6 +432,7 @@
 .claude/skills/scanning-security/SKILL.md linguist-generated=true
 .claude/skills/squashing-history/SKILL.md linguist-generated=true
 .claude/skills/squashing-history/reference.md linguist-generated=true
+.claude/skills/updating-coverage/SKILL.md linguist-generated=true
 .claude/skills/updating-lockstep/SKILL.md linguist-generated=true
 .claude/skills/updating-lockstep/reference.md linguist-generated=true
 .claude/skills/updating-security/SKILL.md linguist-generated=true

CLAUDE.md

@@ -54,6 +54,10 @@ Apply in: worktree creation, base-ref resolution for `git diff`/`git rev-list`,
 - **No AI attribution in drafts either** — when drafting a commit body or PR description, omit "Generated with Claude", "Co-Authored-By: Claude", and robot-emoji-tagged lines (enforced by `.claude/hooks/commit-pr-reminder/`).
 - **Push policy: push, fall back to PR.** Default to `git push origin <branch>` on the current branch (typically `main`). If the push is rejected — branch protection requires a PR, conflicts, signature/identity rejection — open a PR via `gh pr create` against the default base. Don't pre-open PRs "to be safe"; the direct-push happy path is faster for the operator. Don't force-push to recover; resolve the actual cause (rebase to fix conflicts, fix the commit identity, etc.). Reminder fires when `gh pr create` is invoked without an explicit user directive ("PR this", "open a PR") (enforced by `.claude/hooks/pr-vs-push-default-reminder/`).
 
+### Squash-history opt-in
+
+Some fleet repos squash the default branch on a cadence — currently socket-addon, socket-bin, socket-btm, sdxgen, stuie (declared via `optIns: ['squash-history']` in `template/.claude/skills/cascading-fleet/lib/fleet-repos.json`). When working in an opted-in repo, prefer one consolidated commit per logical change over a long fan of tiny WIP commits; the `squashing-history` skill is the documented way to collapse history when it grows long. Threshold reminder + bypass `Allow squash-history-reminder bypass` (enforced by `.claude/hooks/squash-history-reminder/`).
+
 ### Version bumps
 
 🚨 When the user asks for a version bump (`bump to vX.Y.Z`, `tag X.Y.Z`, `release X`, etc.), the sequence is exactly: (1) pre-bump prep wave `pnpm run update` → `pnpm i` → `pnpm run fix --all` → `pnpm run check --all` (each must finish clean); (2) CHANGELOG entry, **public-facing only** — new exports / signature changes / migration recipes, NOT internal refactors or `chore(sync)` cascades; (3) `chore: bump version to X.Y.Z` is the LAST commit on the release; (4) `git tag vX.Y.Z` at that commit (enforced by `.claude/hooks/version-bump-order-guard/`); (5) do NOT dispatch the publish workflow — user-triggered. Full sequence + rationale in [`docs/claude.md/fleet/version-bumps.md`](docs/claude.md/fleet/version-bumps.md).
@@ -65,6 +69,7 @@ Apply in: worktree creation, base-ref resolution for `git diff`/`git rev-list`,
 ### Tooling
 
 - **Package manager**: `pnpm`. Run scripts via `pnpm run foo --flag`, never `foo:bar`. After `package.json` edits, `pnpm install`.
+- **Docs lead with pnpm.** User-facing install commands in fenced code blocks must show the pnpm form first (`pnpm install <pkg>`, `pnpm add <pkg>`). npm / yarn fallbacks are fine but come after — or in a separate block introduced as a fallback. The pre-commit `scanDocsPnpmFirst` scanner emits a warning (not a hard fail) for `.md` / `.mdx` blocks that lead with npm or yarn without a pnpm leader. Suppress per-block with `socket-hook: allow pnpm-first` (HTML comment above the fence or any line inside it).
 - 🚨 NEVER use `npx`, `pnpm dlx`, or `yarn dlx` — use `pnpm exec <package>` or `pnpm run <script>` # socket-hook: allow npx
 - 🚨 NEVER pass `--experimental-strip-types` to Node (enforced by `.claude/hooks/no-experimental-strip-types-guard/`).
 - **New dependencies** — every new dep added to `package.json` runs a Socket-score check at edit time; low-scoring deps block (enforced by `.claude/hooks/check-new-deps/`). The 7-day `minimumReleaseAge` soak is intentional malware protection; never add to `pnpm-workspace.yaml` `minimumReleaseAge.exclude[]` (bypass `Allow minimumReleaseAge bypass` for emergency CVE patches; enforced by `.claude/hooks/minimum-release-age-guard/`). Every per-package soak-bypass entry (the `'pkg@1.2.3'` exact-pin form) MUST carry a `# published: YYYY-MM-DD | removable: YYYY-MM-DD` annotation as the LAST comment line above the bullet — `published` is the version's npm publish date, `removable` is `published + 7d` so a periodic cleanup can drop entries that no longer need the bypass (enforced by `.claude/hooks/soak-exclude-date-annotation-guard/` at edit time + `scripts/check-soak-exclude-dates.mts` at commit time). Vitest `include` globs must not match `node:test` files — mismatched runners produce confusing "no test suite found" errors (enforced by `.claude/hooks/vitest-include-vs-node-test-guard/`).