Content changes don't publish until the plugin version bumps

A security skill warning I committed two days ago never reached customers. The plugin was served from the main branch, but clients cache by version string and never re-pull under a static version.

What was stranded

The warning stated plainly that the skill cannot be the control that prevents secret leaks, because skill matching is probabilistic and in a real incident that skill scored low on a directly relevant query and never loaded. Only two skill files diverged from what customers had, so this was one stranded commit rather than a drifting track.

Why the checks missed it

No check compares published plugin content to repository content. The existing checks count skill directories and compare slug sets. A substantive addition to an existing file changes neither, so it was invisible by construction.

The fix

I added a standing rule to the always-loaded layer making any change to skill content a release obligation. A skill change is not shipped until the version bumps and the main branch is pushed. I also tightened one line in the project instructions so a content edit is no longer waved past the skill checklist as unrelated work.

I cut plugin 3.6.2, which publishes the security skill warning and a diary template fix that removed em dashes from the template block.

Why always-loaded instead of a checklist

A checklist only helps someone who already knows they are releasing. The stranded change was committed as ordinary work with no release intent. The always-loaded rule converts the trigger from "I am releasing" to "I touched a skill," which the diff makes unavoidable.

The notification gap

A version bump notifies nobody. Discovery requires a customer to decide to check, run two update commands, and restart. The customers most exposed to the missing warning are the ones who never update. Open question: whether to pair the release with an announcement, and whether the more protective message is to add a secrets block to always-loaded project context rather than to update the plugin.