docs(claude-ops): record why lanes staleness probe stays a body instruction (#864)

[kyle-sexton]

What

Evaluate the lanes skill's deterministic, read-only git probes against the pinned precompute convention (plugins/playbooks/skills/skill-authoring/reference/precompute-context.md) and either convert each to ! dynamic-context injection or record why it fails the four conditions.

Per-probe verdict

Git probe	Location	Verdict
git rev-parse --show-toplevel (repo root)	SKILL.md front matter	Already converted — ! injection with || echo fallback; shell: bash declared.
git rev-parse --show-toplevel (lane-config resolution)	SKILL.md front matter	Already converted — ! injection with || echo fallback.
staleness probe: git fetch origin + git symbolic-ref + git log <lane-launch-commit>..<default> -- <plugin-path>	context/refresh.md	Recorded reason it fails all four conditions — stays a body instruction.

The two front-matter probes were !-injected at the skill's creation (#616) and gained shell: bash in 0.17.2 — already compliant, nothing to convert.

Why the staleness probe is not an injection candidate

It fails every convention condition:

• Not deterministic/read-only + not cheap/bounded — git fetch is a network round-trip (latency-variable, can hang) that also updates remote-tracking refs.
• Not needed up front every invocation — consulted only when weighing a restart, not on a plain status/stop/start.
• Not judgment-independent — needs a computed <lane-launch-commit> argument (the running lane's launch point) plus the pathspec of whichever plugin the lane runs; a single-pass injection cannot supply either.

Recorded inline in context/refresh.md so a future reader does not re-litigate it.

Automated gate

skill-quality Check 18 (precompute opportunity) scans only SKILL.md fenced shell blocks and is silent when the skill already injects with ! — lanes does — so the gate was already satisfied; this PR adds no new ! blocks.

Changes

• context/refresh.md — durable "Not an ! injection candidate" note next to the staleness probe.
• claude-ops version 0.17.2 → 0.17.3 + matching CHANGELOG entry (changelog-parity gate).

Verification

• check-skill.sh lanes — PASS (0 errors, 0 warnings; markdownlint clean, 163/500 lines)
• check-changelog-parity.sh --check and --check-bump origin/main — PASS
• validate-plugins.sh + claude plugin validate . — PASS
• markdownlint on changed files — 0 errors

Closes #864

Related

• feat(claude-ops): document lane mid-session staleness & restart cadence (#514) #791 — origin of the side-finding
• feat(claude-ops): lanes skill — scripted background loop-lane launcher (#508) #616 — original ! conversion of the front-matter probes
• chore: declare shell: bash on every skill with dynamic-context injections #860 — shell-declaration fleet sweep that added shell: bash

[claude]

Claude finished @kyle-sexton's task in 1m 42s —— View job

---

PR Review

• Gather context and understand the request
• Read changed files
• Review for correctness, security, and alignment with guidelines
• Post final review

---

This is a clean, well-scoped docs + patch-bump PR. Here's what I checked:

plugins/claude-ops/skills/lanes/context/refresh.md — the core change

The added "Not an ! injection candidate" block is logically sound. I verified it against precompute-context.md, which lists four conditions that must all hold for ! injection. The note covers all four:

Convention condition	Addressed in note
Deterministic and read-only	✅ "updates remote-tracking refs"
Needed up front, every time	✅ "conditional, consulted only when weighing a restart"
Independent of Claude's judgement	✅ "needs a computed argument (<lane-launch-commit>, plus the pathspec …)"
Cheap and bounded	✅ "neither bounded nor pure-read — a network round-trip"

One minor observation: the note bundles conditions 1 and 4 under a single "neither bounded nor pure-read" phrase while saying the probe "fails every condition." A reader counting reasons (three in the note) against conditions (four in the referenced doc) might need a moment. It's not wrong — both aspects of the git fetch violation are stated — but an explicit split ("not read-only" / "not cheap") would make the four-for-four claim immediately legible. That said, this is durable rationale for a technical audience already familiar with the precompute doc, so I'd leave it to the author's judgement whether to split.

No bugs, no security concerns here.

plugins/claude-ops/CHANGELOG.md

Correctly placed at the top as [0.17.3], ### Changed, Keep a Changelog format. The summary accurately reflects what changed and cites the issue (#864). No issues.

plugins/claude-ops/.claude-plugin/plugin.json

0.17.2 → 0.17.3 is the right semver tier for a documentation-only patch. No other fields changed. ✅

CLAUDE.md guideline alignment

• No hardcoded paths or project-specific values in the new prose ✅
• No PII or secrets ✅
• Version bumped with changelog-parity ✅
• Plugin-form-safe (no ../ references, no new file writes to plugin data paths) ✅

Overall: LGTM. The reasoning is accurate, the note is durable, and the mechanics (version + changelog) are correct. The one legibility nit above is optional; the PR is mergeable as-is.

[claude]

Claude finished @kyle-sexton's task in 1m 2s —— View job

---

Security Review

• Gather context and read changed files
• Analyze diff for security issues
• Post findings

---

No security issues found.

This PR is a documentation-only change with a version bump. The three changed files introduce no new executable code, no new configuration surfaces, and no new trust boundaries.

What was reviewed:

• plugin.json — version field bumped 0.17.2 → 0.17.3; no other changes; no new userConfig keys, permissions, or external references.
• CHANGELOG.md — prose changelog entry only.
• context/refresh.md — 10 lines of explanatory prose added ("Not an ! injection candidate" block); no new commands, scripts, or interpolation surfaces introduced. The pre-existing illustrative bash snippet (git fetch / git log) was not modified by this PR and falls outside the diff scope.

No GitHub Actions workflows, hook scripts, MCP server definitions, secret-handling paths, or dependency pins were touched.