diff --git a/docs/native-surfaces.md b/docs/native-surfaces.md
index 719f2dd7f8..b35f580382 100644
--- a/docs/native-surfaces.md
+++ b/docs/native-surfaces.md
@@ -1303,6 +1303,8 @@ Pairs a human ruled are not an overlap. `detect` suppresses each one until eithe
 | Native surface | Class | Component | Reason | As of | Date |
 |---|---|---|---|---|---|
 | `Agent` | builtin-tool | `docs-hygiene:write-for-agents` | The Agent tool launches a subagent; ours writes agent-consumed markdown. Shared word only. Ruled 2026-09-29 by operator direction on the orchestrator's recommendation. | 2.1.285 | 2026-09-29 |
+| `Agent` | builtin-tool | `multi-agent:assess` | The Agent tool launches a subagent; ours decides whether a task runs as a workflow, subagents or inline and launches nothing. Complementary, not duplicated. Ruled 2026-10-02 by operator direction on the orchestrator's recommendation. | 2.1.288 | 2026-10-02 |
+| `Agent` | builtin-tool | `multi-agent:route` | The Agent tool launches a subagent; ours resolves which model and effort each agent role gets and launches nothing. Complementary, not duplicated. Ruled 2026-10-02 by operator direction on the orchestrator's recommendation. | 2.1.288 | 2026-10-02 |
 | `Bash` | builtin-tool | `bash-format:check` | Name overlap only: bash-format:check is a read-only check that shfmt, shellcheck and node resolve for the bash-format hook; the built-in Bash tool executes shell commands. Different jobs, no routing. | 2.1.287 | 2026-10-01 |
 | `Bash` | builtin-tool | `bash-format:setup` | The Bash tool runs shell commands; ours sets up the shell-script formatter hook. Shared word only. Ruled 2026-09-29 by operator direction on the orchestrator's recommendation. | 2.1.285 | 2026-10-01 |
 | `ClaudeDesign` | builtin-tool | `evals:design` | The ClaudeDesign tool edits claude.ai/design canvas projects; ours designs an LLM evaluation suite. Shared word only. Ruled 2026-10-01 by operator direction on the orchestrator's recommendation. | 2.1.285 | 2026-10-01 |
@@ -1333,6 +1335,8 @@ Pairs a human ruled are not an overlap. `detect` suppresses each one until eithe
 | `Write` | builtin-tool | `docs-hygiene:write-for-agents` | The Write tool writes a file; ours authors agent-consumed markdown. Shared word only. Ruled 2026-09-29 by operator direction on the orchestrator's recommendation. | 2.1.285 | 2026-09-29 |
 | `Write` | builtin-tool | `docs-hygiene:write-for-humans` | The Write tool writes a file; ours authors human-facing prose. Shared word only. Ruled 2026-09-29 by operator direction on the orchestrator's recommendation. | 2.1.285 | 2026-09-29 |
 | `agents` | builtin-command | `docs-hygiene:write-for-agents` | /agents manages subagents (its registration now reads "(removed)"); ours writes agent-consumed markdown. Shared word only. Ruled 2026-09-29 by operator direction on the orchestrator's recommendation. | 2.1.284 | 2026-09-29 |
+| `agents` | builtin-command | `multi-agent:assess` | /agents manages subagents (its registration reads "(removed)"); ours decides whether a task runs as a workflow, subagents or inline. Shared word only. Ruled 2026-10-02 by operator direction on the orchestrator's recommendation. | 2.1.288 | 2026-10-02 |
+| `agents` | builtin-command | `multi-agent:route` | /agents manages subagents (its registration reads "(removed)"); ours resolves the model and effort per agent role. Shared word only. Ruled 2026-10-02 by operator direction on the orchestrator's recommendation. | 2.1.288 | 2026-10-02 |
 | `artifact-design` | bundled-skill | `planning:design` | Design guidance for Artifact pages versus resolving code design decisions (types, contracts, module boundaries). Shared word only. Ruled 2026-09-29 by operator direction on the orchestrator's recommendation. | 2.1.284 | 2026-09-29 |
 | `artifact-explainer` | bundled-skill | `review:pr-explainer` | The bundled skill publishes a concept walkthrough artifact; ours explains one pull request's diff as a local HTML page. Shared word only. Ruled 2026-09-29 by operator direction on the orchestrator's recommendation. | 2.1.284 | 2026-09-29 |
 | `artifact-pr-review` | bundled-skill | `source-control:babysit-prs` | A PR review briefing artifact versus a loop that advances the user's open PRs. Shared PR vocabulary only. Ruled 2026-09-29 by operator direction on the orchestrator's recommendation. | 2.1.284 | 2026-09-29 |
@@ -1346,14 +1350,16 @@ Pairs a human ruled are not an overlap. `detect` suppresses each one until eithe
 | `bug` | builtin-command | `bugs:setup` | /bug reports a Claude Code bug to Anthropic; ours configures the bugs plugin for a repository. The reporting overlap is recorded against bugs:write. Ruled 2026-09-29 by operator direction on the orchestrator's recommendation. | 2.1.284 | 2026-09-29 |
 | `cc-plugin-agents-md` | plugin-backed-builtin | `docs-hygiene:write-for-agents` | The built-in agents-md plugin loads AGENTS.md as project instructions; ours writes agent-consumed markdown. Loader versus writer, shared words only. Ruled 2026-10-01 by operator direction on the orchestrator's recommendation. | 2.1.287 | 2026-10-01 |
 | `cc-plugin-claude-test` | plugin-backed-builtin | `prototype:pressure-test` | The built-in claude-test plugin runs plain-language specs against a local dev server in a browser; ours builds a throwaway terminal app to pressure-test logic before committing to it. Shared word only. Ruled 2026-10-01 by operator direction on the orchestrator's recommendation. | 2.1.287 | 2026-10-01 |
+| `cc-plugin-claude-test` | plugin-backed-builtin | `testing:run-e2e` | The plugin node and its claude-test skill are one surface; the store's claude-test -\> testing:run-e2e defer row (2026-10-01) carries this ruling. Ruled 2026-10-02 by operator direction on the orchestrator's recommendation. | 2.1.288 | 2026-10-02 |
 | `cc-plugin-claude-test` | plugin-backed-builtin | `testing:setup` | The built-in claude-test plugin runs plain-language specs against a local dev server in a browser; ours configures the testing plugin's can't-fail checks for a repository. Shared word only. Ruled 2026-10-01 by operator direction on the orchestrator's recommendation. | 2.1.287 | 2026-10-01 |
 | `cc-plugin-claude-test` | plugin-backed-builtin | `testing:test-value` | The built-in claude-test plugin runs plain-language specs against a local dev server in a browser; ours is guidance on what makes a test worth keeping. Shared word only. Ruled 2026-10-01 by operator direction on the orchestrator's recommendation. | 2.1.287 | 2026-10-01 |
 | `cc-plugin-plugin-authoring` | plugin-backed-builtin | `playbooks:skill-authoring` | The built-in plugin-authoring plugin teaches writing a mod, a plugin of function hooks; ours is the skill-authoring playbook. Shared word only. Ruled 2026-10-01 by operator direction on the orchestrator's recommendation. | 2.1.287 | 2026-10-01 |
 | `claude-code-docs` | bundled-skill | `review:doc-drift-detector (agent)` | Answers questions about Claude Code features versus an agent that finds stale documentation in a repository. Shared word only. Ruled 2026-09-29 by operator direction on the orchestrator's recommendation. | 2.1.284 | 2026-09-29 |
-| `claude-test` | plugin-backed-builtin | `prototype:pressure-test` | The built-in claude-test skill runs plain-language specs against a local dev server in a browser; ours builds a throwaway terminal app to pressure-test logic before committing to it. Shared word only. Ruled 2026-10-01 by operator direction on the orchestrator's recommendation. | 2.1.287 | 2026-10-01 |
-| `claude-test` | plugin-backed-builtin | `testing:test-value` | The built-in claude-test skill runs plain-language specs against a local dev server in a browser; ours is guidance on what makes a test worth keeping. Shared word only. Ruled 2026-10-01 by operator direction on the orchestrator's recommendation. | 2.1.287 | 2026-10-01 |
+| `claude-test` | plugin-backed-builtin | `mutation-testing:audit` | The built-in claude-test skill runs Claude Test specs against a local dev server; ours runs mutation analysis and reports surviving mutants. Shared word only. Ruled 2026-10-02 by operator direction on the orchestrator's recommendation. | 2.1.288 | 2026-10-02 |
+| `claude-test` | plugin-backed-builtin | `prototype:pressure-test` | The built-in claude-test skill runs Claude Test specs against a local dev server; ours builds a throwaway terminal app to pressure-test logic before committing to it. Shared word only. Ruled 2026-10-02 by operator direction on the orchestrator's recommendation. | 2.1.288 | 2026-10-02 |
+| `claude-test` | plugin-backed-builtin | `testing:test-value` | The built-in claude-test skill runs Claude Test specs against a local dev server; ours is guidance on what makes a test worth keeping. Shared word only. Ruled 2026-10-02 by operator direction on the orchestrator's recommendation. | 2.1.288 | 2026-10-02 |
 | `claude-test-draft` | plugin-backed-builtin | `harness-config:draft-auto-mode-rules` | The built-in claude-test-draft skill drafts Claude Test spec files in the background; ours drafts autoMode classifier rules. Shared word only. Ruled 2026-10-01 by operator direction on the orchestrator's recommendation. | 2.1.287 | 2026-10-01 |
-| `code-review` | bundled-skill | `review:security-review` | The bundled skill reviews for correctness bugs; ours is the CI security lane. The security pair is recorded as security-review -\> review:security-review. Ruled 2026-09-29 by operator direction on the orchestrator's recommendation. | 2.1.285 | 2026-10-01 |
+| `code-review` | bundled-skill | `review:security-review` | The bundled skill reviews for correctness bugs; ours is the CI security lane. The security pair is recorded as security-review -\> review:security-review. Ruled 2026-10-02 by operator direction on the orchestrator's recommendation. | 2.1.288 | 2026-10-02 |
 | `commit-push-pr` | builtin-command | `review:pr-explainer` | Commits, pushes, and opens a PR versus explaining an existing PR's diff. Shared PR vocabulary only. Ruled 2026-09-29 by operator direction on the orchestrator's recommendation. | 2.1.284 | 2026-09-29 |
 | `config` | builtin-command | `harness-config:audit` | /config opens the preferences UI (theme, model, output style); ours audits settings files for correctness and drift. Shared word only. Ruled 2026-09-29 by operator direction on the orchestrator's recommendation. | 2.1.285 | 2026-10-01 |
 | `config` | builtin-command | `harness-config:audit-permission-grants` | /config opens the settings UI; ours audits permission grants for portability and auto-mode durability. Shared word only. Ruled 2026-10-01 by operator direction on the orchestrator's recommendation. | 2.1.285 | 2026-10-01 |
@@ -1393,24 +1399,27 @@ Pairs a human ruled are not an overlap. `detect` suppresses each one until eithe
 | `plugin-authoring` | plugin-backed-builtin | `playbooks:skill-authoring` | The built-in plugin-authoring skill teaches writing a mod, a plugin of function hooks; ours is the skill-authoring playbook. Shared word only. Ruled 2026-10-01 by operator direction on the orchestrator's recommendation. | 2.1.287 | 2026-10-01 |
 | `pr` | bundled-skill | `review:pr-explainer` | Creates a pull request versus explaining an existing one. Shared PR vocabulary only. Ruled 2026-09-29 by operator direction on the orchestrator's recommendation. | 2.1.284 | 2026-09-29 |
 | `pr` | bundled-skill | `source-control:babysit-prs` | Creates one pull request versus a loop that advances already-open ones. The creation pair is recorded against source-control:pull-request. Ruled 2026-09-29 by operator direction on the orchestrator's recommendation. | 2.1.284 | 2026-09-29 |
+| `rename` | builtin-command | `docs-hygiene:rename-references` | /rename renames the conversation; ours sweeps stale references after a file or symbol rename. Shared word only. Ruled 2026-10-02 by operator direction on the orchestrator's recommendation. | 2.1.288 | 2026-10-02 |
 | `rename` | builtin-command | `docs-naming:audit-file-names` | /rename renames the conversation; ours audits a docs tree's file names. Shared word only. Ruled 2026-09-29 by operator direction on the orchestrator's recommendation. | 2.1.284 | 2026-09-29 |
 | `rename` | builtin-command | `docs-naming:realign-file-names` | /rename renames the conversation; ours applies a file rename plan. Shared word only. Ruled 2026-09-29 by operator direction on the orchestrator's recommendation. | 2.1.284 | 2026-09-29 |
 | `rename` | builtin-command | `naming:name-it-better` | /rename renames the conversation; ours generates names for code and domain terms. Shared word only. Ruled 2026-09-29 by operator direction on the orchestrator's recommendation. | 2.1.284 | 2026-09-29 |
+| `restart` | builtin-command | `firecrawl:update` | /restart (alias /update) restarts Claude Code and keeps the session; ours drift-checks the firecrawl wrapper against its upstream. Shared word only. Ruled 2026-10-02 by operator direction on the orchestrator's recommendation. | 2.1.288 | 2026-10-02 |
+| `restart` | builtin-command | `playbooks:update` | /restart (alias /update) restarts Claude Code and keeps the session; ours drift-checks the playbooks plugin's vendored packs. Shared word only. Ruled 2026-10-02 by operator direction on the orchestrator's recommendation. | 2.1.288 | 2026-10-02 |
 | `resume` | builtin-command | `session-flow:continue-in-background` | /resume reopens a previous conversation; ours launches a new detached session to carry the current work. Shared word only. Ruled 2026-09-29 by operator direction on the orchestrator's recommendation. | 2.1.284 | 2026-09-29 |
 | `runner` | plugin-backed-builtin | `session-flow:running-retro` | The built-in claude-test plugin's runner agent drives the app under test in a fenced browser; ours files mid-session retro findings. Shared word only. Ruled 2026-10-01 by operator direction on the orchestrator's recommendation. | 2.1.287 | 2026-10-01 |
 | `security-review` | plugin-backed-builtin | `review:code-reviewer (agent)` | The code-reviewer agent leaves security to security-reviewer by its own description. The security pair is recorded against review:security-reviewer. Ruled 2026-09-29 by operator direction on the orchestrator's recommendation. | 2.1.284 | 2026-09-29 |
 | `stop` | builtin-command | `session-flow:clean-stop` | /stop ends a background session; ours sweeps repositories for unpushed work before the machine goes away. Shared word only. Ruled 2026-09-29 by operator direction on the orchestrator's recommendation. | 2.1.284 | 2026-09-29 |
-| `update` | builtin-command | `firecrawl:update` | /update switches Claude Code to the latest version; ours drift-checks the firecrawl wrapper against its upstream. Shared word only. Ruled 2026-09-29 by operator direction on the orchestrator's recommendation. | 2.1.284 | 2026-09-29 |
-| `update` | builtin-command | `playbooks:update` | /update switches Claude Code to the latest version; ours drift-checks the playbooks plugin's vendored packs. Shared word only. Ruled 2026-09-29 by operator direction on the orchestrator's recommendation. | 2.1.284 | 2026-09-29 |
 | `update-config` | bundled-skill | `firecrawl:update` | Edits Claude Code settings.json versus drift-checking the firecrawl wrapper against its upstream. Shared word only. Ruled 2026-09-29 by operator direction on the orchestrator's recommendation. | 2.1.284 | 2026-09-29 |
 | `verify` | bundled-skill | `performance:verify` | Exercises a code change end to end versus re-deriving a performance measurement in a fresh context. Shared word only. Ruled 2026-09-29 by operator direction on the orchestrator's recommendation. | 2.1.284 | 2026-09-29 |
 | `verify` | bundled-skill | `verification:setup` | The bundled verify skill exercises a code change end to end before committing; verification:setup reports where the verification plugin's artifacts land. Both are user-only, so no routing exists. Shared words only. Ruled 2026-10-01 by operator direction on the orchestrator's recommendation. | 2.1.287 | 2026-10-01 |
 | `worker` | builtin-agent | `discipline:script-the-deterministic-work` | The worker agent executes a delegated task; ours is a scripting discipline corrector. Shared word only. Ruled 2026-09-29 by operator direction on the orchestrator's recommendation. | 2.1.285 | 2026-09-29 |
+| `worker` | builtin-agent | `discovery:sweep-worker (agent)` | The worker agent executes a delegated task; ours runs one stage of the discovery:research-sweep workflow and is dispatched only by it. Shared word only. Ruled 2026-10-02 by operator direction on the orchestrator's recommendation. | 2.1.288 | 2026-10-02 |
 | `worker` | builtin-agent | `session-flow:tidy-work` | Name overlap only ('work'): tidy-work is a user-only skill that tidies the gitignored .work memory tiers; the built-in worker agent executes delegated tasks. Different jobs, no routing. | 2.1.285 | 2026-09-30 |
 | `worker` | builtin-agent | `work-items:work` | The worker agent executes a delegated task; ours picks and executes a tracker item end to end. Shared word only. Ruled 2026-09-29 by operator direction on the orchestrator's recommendation. | 2.1.285 | 2026-09-29 |
 | `worker` | builtin-agent | `work-items:work-loop` | The worker agent executes a delegated task; ours drains a tracker backlog as a loop. Shared word only. Ruled 2026-09-29 by operator direction on the orchestrator's recommendation. | 2.1.285 | 2026-09-29 |
 | `workflow-authoring` | bundled-skill | `playbooks:skill-authoring` | Reference for Workflow tool scripts versus SKILL.md authoring guidance. Shared word only. Ruled 2026-09-29 by operator direction on the orchestrator's recommendation. | 2.1.285 | 2026-10-01 |
 | `workflow-authoring` | bundled-skill | `songwriting:workflow` | Reference for Workflow tool scripts versus a songwriting situation router. Shared word only. Ruled 2026-09-29 by operator direction on the orchestrator's recommendation. | 2.1.285 | 2026-10-01 |
+| `workflow-subagent` | builtin-agent | `multi-agent:assess` | workflow-subagent is an internal, gated agent that workflow scripts run; ours decides whether a task should be a workflow at all. Shared word only. Ruled 2026-10-02 by operator direction on the orchestrator's recommendation. | 2.1.288 | 2026-10-02 |
 | `workflows` | builtin-command | `session-flow:workflow` | /workflows browses Workflow tool runs; ours navigates staged engineering work. Shared word only. Ruled 2026-09-29 by operator direction on the orchestrator's recommendation. | 2.1.284 | 2026-09-29 |
 | `workflows` | builtin-command | `songwriting:workflow` | /workflows browses Workflow tool runs; ours routes a songwriting session. Shared word only. Ruled 2026-09-29 by operator direction on the orchestrator's recommendation. | 2.1.284 | 2026-09-29 |
 
diff --git a/docs/native-surfaces/records.json b/docs/native-surfaces/records.json
index 6742758d39..228a5ea22e 100644
--- a/docs/native-surfaces/records.json
+++ b/docs/native-surfaces/records.json
@@ -2917,6 +2917,42 @@
         "component": "e86f6506f34e1755f133f801bf57677e"
       }
     },
+    {
+      "native": {
+        "name": "Agent",
+        "class": "builtin-tool"
+      },
+      "component": {
+        "plugin": "multi-agent",
+        "skill": "assess",
+        "kind": "skill"
+      },
+      "reason": "The Agent tool launches a subagent; ours decides whether a task runs as a workflow, subagents or inline and launches nothing. Complementary, not duplicated. Ruled 2026-10-02 by operator direction on the orchestrator's recommendation.",
+      "as_of": "2.1.288",
+      "date": "2026-10-02",
+      "fingerprint": {
+        "native": "2331a2afb78bb465504bc6223af08a9b",
+        "component": "4fc5c423020ada26d256c4ebbe966cce"
+      }
+    },
+    {
+      "native": {
+        "name": "Agent",
+        "class": "builtin-tool"
+      },
+      "component": {
+        "plugin": "multi-agent",
+        "skill": "route",
+        "kind": "skill"
+      },
+      "reason": "The Agent tool launches a subagent; ours resolves which model and effort each agent role gets and launches nothing. Complementary, not duplicated. Ruled 2026-10-02 by operator direction on the orchestrator's recommendation.",
+      "as_of": "2.1.288",
+      "date": "2026-10-02",
+      "fingerprint": {
+        "native": "2331a2afb78bb465504bc6223af08a9b",
+        "component": "553f214ea07616b6be3bc9719e1cf8ee"
+      }
+    },
     {
       "native": {
         "name": "Bash",
@@ -3457,6 +3493,42 @@
         "component": "e86f6506f34e1755f133f801bf57677e"
       }
     },
+    {
+      "native": {
+        "name": "agents",
+        "class": "builtin-command"
+      },
+      "component": {
+        "plugin": "multi-agent",
+        "skill": "assess",
+        "kind": "skill"
+      },
+      "reason": "/agents manages subagents (its registration reads \"(removed)\"); ours decides whether a task runs as a workflow, subagents or inline. Shared word only. Ruled 2026-10-02 by operator direction on the orchestrator's recommendation.",
+      "as_of": "2.1.288",
+      "date": "2026-10-02",
+      "fingerprint": {
+        "native": "50803a5285096ddfa642be9e0d31533f",
+        "component": "4fc5c423020ada26d256c4ebbe966cce"
+      }
+    },
+    {
+      "native": {
+        "name": "agents",
+        "class": "builtin-command"
+      },
+      "component": {
+        "plugin": "multi-agent",
+        "skill": "route",
+        "kind": "skill"
+      },
+      "reason": "/agents manages subagents (its registration reads \"(removed)\"); ours resolves the model and effort per agent role. Shared word only. Ruled 2026-10-02 by operator direction on the orchestrator's recommendation.",
+      "as_of": "2.1.288",
+      "date": "2026-10-02",
+      "fingerprint": {
+        "native": "50803a5285096ddfa642be9e0d31533f",
+        "component": "553f214ea07616b6be3bc9719e1cf8ee"
+      }
+    },
     {
       "native": {
         "name": "artifact-design",
@@ -3691,6 +3763,24 @@
         "component": "b1d0ebecb379ca7a6eb4cf82d701620d"
       }
     },
+    {
+      "native": {
+        "name": "cc-plugin-claude-test",
+        "class": "plugin-backed-builtin"
+      },
+      "component": {
+        "plugin": "testing",
+        "skill": "run-e2e",
+        "kind": "skill"
+      },
+      "reason": "The plugin node and its claude-test skill are one surface; the store's claude-test -> testing:run-e2e defer row (2026-10-01) carries this ruling. Ruled 2026-10-02 by operator direction on the orchestrator's recommendation.",
+      "as_of": "2.1.288",
+      "date": "2026-10-02",
+      "fingerprint": {
+        "native": "bdca54a963f338f3d5b08615eb951993",
+        "component": "5aecd2cd670a3ba3d9b72f46d7e0792d"
+      }
+    },
     {
       "native": {
         "name": "cc-plugin-claude-test",
@@ -3763,6 +3853,24 @@
         "component": "9a5e3c9aa794d112f1b47e88d8909060"
       }
     },
+    {
+      "native": {
+        "name": "claude-test",
+        "class": "plugin-backed-builtin"
+      },
+      "component": {
+        "plugin": "mutation-testing",
+        "skill": "audit",
+        "kind": "skill"
+      },
+      "reason": "The built-in claude-test skill runs Claude Test specs against a local dev server; ours runs mutation analysis and reports surviving mutants. Shared word only. Ruled 2026-10-02 by operator direction on the orchestrator's recommendation.",
+      "as_of": "2.1.288",
+      "date": "2026-10-02",
+      "fingerprint": {
+        "native": "78890721f4173755e2659ef0881f4923",
+        "component": "81f6074467343662a9fb2831daf55640"
+      }
+    },
     {
       "native": {
         "name": "claude-test",
@@ -3773,11 +3881,11 @@
         "skill": "pressure-test",
         "kind": "skill"
       },
-      "reason": "The built-in claude-test skill runs plain-language specs against a local dev server in a browser; ours builds a throwaway terminal app to pressure-test logic before committing to it. Shared word only. Ruled 2026-10-01 by operator direction on the orchestrator's recommendation.",
-      "as_of": "2.1.287",
-      "date": "2026-10-01",
+      "reason": "The built-in claude-test skill runs Claude Test specs against a local dev server; ours builds a throwaway terminal app to pressure-test logic before committing to it. Shared word only. Ruled 2026-10-02 by operator direction on the orchestrator's recommendation.",
+      "as_of": "2.1.288",
+      "date": "2026-10-02",
       "fingerprint": {
-        "native": "2167546b6a0f6c522af542dc86243406",
+        "native": "78890721f4173755e2659ef0881f4923",
         "component": "b1d0ebecb379ca7a6eb4cf82d701620d"
       }
     },
@@ -3791,11 +3899,11 @@
         "skill": "test-value",
         "kind": "skill"
       },
-      "reason": "The built-in claude-test skill runs plain-language specs against a local dev server in a browser; ours is guidance on what makes a test worth keeping. Shared word only. Ruled 2026-10-01 by operator direction on the orchestrator's recommendation.",
-      "as_of": "2.1.287",
-      "date": "2026-10-01",
+      "reason": "The built-in claude-test skill runs Claude Test specs against a local dev server; ours is guidance on what makes a test worth keeping. Shared word only. Ruled 2026-10-02 by operator direction on the orchestrator's recommendation.",
+      "as_of": "2.1.288",
+      "date": "2026-10-02",
       "fingerprint": {
-        "native": "2167546b6a0f6c522af542dc86243406",
+        "native": "78890721f4173755e2659ef0881f4923",
         "component": "ce076b3ced24d3c7b11594070f416336"
       }
     },
@@ -3827,11 +3935,11 @@
         "skill": "security-review",
         "kind": "skill"
       },
-      "reason": "The bundled skill reviews for correctness bugs; ours is the CI security lane. The security pair is recorded as security-review -> review:security-review. Ruled 2026-09-29 by operator direction on the orchestrator's recommendation.",
-      "as_of": "2.1.285",
-      "date": "2026-10-01",
+      "reason": "The bundled skill reviews for correctness bugs; ours is the CI security lane. The security pair is recorded as security-review -> review:security-review. Ruled 2026-10-02 by operator direction on the orchestrator's recommendation.",
+      "as_of": "2.1.288",
+      "date": "2026-10-02",
       "fingerprint": {
-        "native": "8598387da809a2243d7352d66d98b8a1",
+        "native": "64849eb7040a3c8e17892ba163f7891e",
         "component": "071455025613ebdd302b735cf719f523"
       }
     },
@@ -4537,6 +4645,24 @@
         "component": "735a8fbb6c179723abbbe513f49aa84b"
       }
     },
+    {
+      "native": {
+        "name": "rename",
+        "class": "builtin-command"
+      },
+      "component": {
+        "plugin": "docs-hygiene",
+        "skill": "rename-references",
+        "kind": "skill"
+      },
+      "reason": "/rename renames the conversation; ours sweeps stale references after a file or symbol rename. Shared word only. Ruled 2026-10-02 by operator direction on the orchestrator's recommendation.",
+      "as_of": "2.1.288",
+      "date": "2026-10-02",
+      "fingerprint": {
+        "native": "b7b277e905dba7621cb48e6eef55ae23",
+        "component": "3dd11aa7afb7ac4bdf88bbfffb2c1845"
+      }
+    },
     {
       "native": {
         "name": "rename",
@@ -4591,6 +4717,42 @@
         "component": "97c74e4dd0405715716d8d485d574633"
       }
     },
+    {
+      "native": {
+        "name": "restart",
+        "class": "builtin-command"
+      },
+      "component": {
+        "plugin": "firecrawl",
+        "skill": "update",
+        "kind": "skill"
+      },
+      "reason": "/restart (alias /update) restarts Claude Code and keeps the session; ours drift-checks the firecrawl wrapper against its upstream. Shared word only. Ruled 2026-10-02 by operator direction on the orchestrator's recommendation.",
+      "as_of": "2.1.288",
+      "date": "2026-10-02",
+      "fingerprint": {
+        "native": "6d1f64a559c628d115c0cac5dd28a6b1",
+        "component": "8c207489dfa7c594a4586ed51cc1dad4"
+      }
+    },
+    {
+      "native": {
+        "name": "restart",
+        "class": "builtin-command"
+      },
+      "component": {
+        "plugin": "playbooks",
+        "skill": "update",
+        "kind": "skill"
+      },
+      "reason": "/restart (alias /update) restarts Claude Code and keeps the session; ours drift-checks the playbooks plugin's vendored packs. Shared word only. Ruled 2026-10-02 by operator direction on the orchestrator's recommendation.",
+      "as_of": "2.1.288",
+      "date": "2026-10-02",
+      "fingerprint": {
+        "native": "6d1f64a559c628d115c0cac5dd28a6b1",
+        "component": "fcd86b079d31c37cf759c9241c5a4b42"
+      }
+    },
     {
       "native": {
         "name": "resume",
@@ -4663,42 +4825,6 @@
         "component": "6dbc0857c2afc2636edbf9de4e4a9a60"
       }
     },
-    {
-      "native": {
-        "name": "update",
-        "class": "builtin-command"
-      },
-      "component": {
-        "plugin": "firecrawl",
-        "skill": "update",
-        "kind": "skill"
-      },
-      "reason": "/update switches Claude Code to the latest version; ours drift-checks the firecrawl wrapper against its upstream. Shared word only. Ruled 2026-09-29 by operator direction on the orchestrator's recommendation.",
-      "as_of": "2.1.284",
-      "date": "2026-09-29",
-      "fingerprint": {
-        "native": "8969b4589bd827224bb6f0975ca719ad",
-        "component": "8c207489dfa7c594a4586ed51cc1dad4"
-      }
-    },
-    {
-      "native": {
-        "name": "update",
-        "class": "builtin-command"
-      },
-      "component": {
-        "plugin": "playbooks",
-        "skill": "update",
-        "kind": "skill"
-      },
-      "reason": "/update switches Claude Code to the latest version; ours drift-checks the playbooks plugin's vendored packs. Shared word only. Ruled 2026-09-29 by operator direction on the orchestrator's recommendation.",
-      "as_of": "2.1.284",
-      "date": "2026-09-29",
-      "fingerprint": {
-        "native": "8969b4589bd827224bb6f0975ca719ad",
-        "component": "fcd86b079d31c37cf759c9241c5a4b42"
-      }
-    },
     {
       "native": {
         "name": "update-config",
@@ -4771,6 +4897,24 @@
         "component": "b30c829b801f29dd87dbba3477fc0f60"
       }
     },
+    {
+      "native": {
+        "name": "worker",
+        "class": "builtin-agent"
+      },
+      "component": {
+        "plugin": "discovery",
+        "skill": "sweep-worker",
+        "kind": "agent"
+      },
+      "reason": "The worker agent executes a delegated task; ours runs one stage of the discovery:research-sweep workflow and is dispatched only by it. Shared word only. Ruled 2026-10-02 by operator direction on the orchestrator's recommendation.",
+      "as_of": "2.1.288",
+      "date": "2026-10-02",
+      "fingerprint": {
+        "native": "cbc1f297a2e2195d9616355d9371b597",
+        "component": "b7ac81cb968bdeaf46ed952187358f0b"
+      }
+    },
     {
       "native": {
         "name": "worker",
@@ -4861,6 +5005,24 @@
         "component": "57f30812b809930d11e028dada56bb15"
       }
     },
+    {
+      "native": {
+        "name": "workflow-subagent",
+        "class": "builtin-agent"
+      },
+      "component": {
+        "plugin": "multi-agent",
+        "skill": "assess",
+        "kind": "skill"
+      },
+      "reason": "workflow-subagent is an internal, gated agent that workflow scripts run; ours decides whether a task should be a workflow at all. Shared word only. Ruled 2026-10-02 by operator direction on the orchestrator's recommendation.",
+      "as_of": "2.1.288",
+      "date": "2026-10-02",
+      "fingerprint": {
+        "native": "ae56ba693ef657a23c778af14e00f51e",
+        "component": "4fc5c423020ada26d256c4ebbe966cce"
+      }
+    },
     {
       "native": {
         "name": "workflows",
diff --git a/plugins/discovery/.claude-plugin/plugin.json b/plugins/discovery/.claude-plugin/plugin.json
index e8a14ea396..8ba4021e85 100644
--- a/plugins/discovery/.claude-plugin/plugin.json
+++ b/plugins/discovery/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "discovery",
-  "version": "0.26.1",
+  "version": "0.26.2",
   "description": "Structured discovery before changes: explore the local codebase, run disciplined multi-source external research, and reconstruct why a past decision was made from evidence outside the code. Each dispatches a purpose-built subagent by default so the reading stays out of the main conversation, with source tiers, falsification, recency gates, an intent-evidence tier, and a corpus-coverage ledger, and each persists EXPLORE.md / RESEARCH.md / INTENT.md index-plus-sidecar handoff artifacts. A research sweep workflow (/discovery:research-sweep) backs deep research with adversarial claim verification.",
   "author": {
     "name": "Melodic Software",
diff --git a/plugins/discovery/CHANGELOG.md b/plugins/discovery/CHANGELOG.md
index 03c8d54e09..007c635806 100644
--- a/plugins/discovery/CHANGELOG.md
+++ b/plugins/discovery/CHANGELOG.md
@@ -1,5 +1,15 @@
 # Changelog: discovery plugin
 
+## [0.26.2] - 2026-10-02
+
+### Fixed
+
+- **The `Explore` verification record points at the live disallowed-tool list.**
+  `reference/native-explore.md` named four tools from the 2.1.285 extraction; on Claude Code
+  2.1.288 the agent disallows nine. The record now states what that means for this skill (it
+  cannot edit files or spawn an agent) and points at `builtin_agents.Explore.disallowed_tools`
+  in the inventory instead of copying the list.
+
 ## [0.26.1] - 2026-10-02
 
 ### Added
diff --git a/plugins/discovery/skills/explore/reference/native-explore.md b/plugins/discovery/skills/explore/reference/native-explore.md
index efa669ca4e..0964218586 100644
--- a/plugins/discovery/skills/explore/reference/native-explore.md
+++ b/plugins/discovery/skills/explore/reference/native-explore.md
@@ -6,8 +6,8 @@ worth checking again.
 
 | Claim | Basis | As of | Recheck when |
 |---|---|---|---|
-| `Explore` is a built-in subagent described as a "fast read-only search agent for locating code", told not to be used for code review, design-doc auditing, or open-ended analysis because it reads excerpts | The `/harness-ops:inventory` extraction of the installed 2.1.285 binary (`builtin_agents.Explore`) | 2026-09-29 | A release renames or removes `Explore`, or changes its description |
-| It is model-invocable, gated, and on a conditional roster; Edit, Write, NotebookEdit, and Agent are disallowed, and it omits CLAUDE.md | Same extraction: `model_invocable: true`, `gated: true`, `roster: conditional`, `disallowed_tools`, `omit_claude_md: true` | 2026-09-29 | A release changes its tools, its CLAUDE.md loading, or its gating |
+| `Explore` is a built-in subagent described as a "fast read-only search agent for locating code", told not to be used for code review, design-doc auditing, or open-ended analysis because it reads excerpts | The `/harness-ops:inventory` extraction of the installed 2.1.288 binary (`builtin_agents.Explore`) | 2026-10-02 | A release renames or removes `Explore`, or changes its description |
+| It is model-invocable, gated, and on a conditional roster; it cannot edit files or spawn an agent, and it omits CLAUDE.md | Same extraction: `model_invocable: true`, `gated: true`, `roster: conditional`, `omit_claude_md: true`; the current disallowed-tool list is `builtin_agents.Explore.disallowed_tools` in a fresh run | 2026-10-02 | A release changes its tools, its CLAUDE.md loading, or its gating |
 | `CLAUDE_CODE_DISABLE_EXPLORE_PLAN_AGENTS=1` removes it, and a user or project subagent named `Explore` overrides it | <https://code.claude.com/docs/en/sub-agents>, "Built-in subagents" | 2026-09-29 | The page changes how the built-in agents are disabled or overridden |
 
 The denials that make `Explore` a scout rather than this skill's worker (no Write, no preloaded
diff --git a/plugins/harness-ops/.claude-plugin/plugin.json b/plugins/harness-ops/.claude-plugin/plugin.json
index 2059113e53..1bfa49dea5 100644
--- a/plugins/harness-ops/.claude-plugin/plugin.json
+++ b/plugins/harness-ops/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "harness-ops",
-  "version": "2.5.2",
+  "version": "2.5.3",
   "description": "Claude Code operations toolkit. Fifteen skills: audit-skill-visibility (audit whether each installed skill is actually VISIBLE to the model, and diagnose why most of a fleet never gets used: a skill is invisible when its description is dropped by Claude Code's skill-listing context budget, which sheds descriptions lowest-score-first so an unused skill loses the keywords that would let it be matched, from skills genuinely not wanted, from skills the run cannot observe at all; computes whether the listing overflows from documented settings, and withholds every cold verdict the data cannot support rather than reporting absence of data as absence of use), inventory (read-only enumeration of the complete invocable surface: every built-in CLI command with aliases and hidden/gated status, every bundled skill, every built-in subagent and tool, every built-in plugin with its components, and every component of every installed plugin across all marketplaces; reads the shipped binary because upstream publishes no built-in command list, and carries an integrity verdict so a drifted build reports counts as floors rather than silently short totals), audit-install-state (read-only audit of the machine-scope ~/.claude installation directory and ~/.claude.json: full inventory split into an authored surface and rolled-up bulk trees, product-managed retention vs genuinely unmanaged state, filename-scheme resolution before any process-liveness check, and deliberate/mid-experiment detection; reports, never deletes), audit-performance (read-only slowness-diagnostic capture run at the moment the machine or a session feels slow: CLI version, retention-sweep health including the unparsable-settings pause, which warns in /status, a timed census walk of the install tree as a sweep-cost proxy, active-session and plugin-fleet counts, a process census, and the fan-out layer, which covers a load-labeled no-op spawn baseline, every hook that will fire bucketed per-tool-call versus per-turn with its invocation shape, the configured statusline, subagent concurrency and spawn-depth ceilings against documented defaults, whether running sessions predate the settings file they are judged by, and orphan attribution by parent liveness rather than age, plus on Windows a kernel-object census (Token objects against uptime, paged pool) that names a host-level leak beneath all four suspects; read against a bundled known-performance-issues reference that also records the causes tested and cleared; separates the four documented suspects of accumulated state, version regression, component bloat, and per-spawn fan-out cost, and routes remediation out; reports, never mutates, and never executes a discovered hook or statusline command), audit-native-overlap (map native Claude Code surfaces, namely built-in CLI commands, bundled skills, plugin-backed built-ins, and session-provided skills, against the current repo's plugin skills and agents, so a custom component never silently duplicates what Claude Code itself ships; bare invocation is a read-only overlap report carrying the extraction's integrity floors and a shared-listing-budget exposure section, verdicts are human-gated in a committed store rendered into a generated registry whose every row carries an observable recheck trigger, and only an explicit apply step bakes presence-gated native references into descriptions and Boundary sections), observability (read locally captured telemetry from the OTEL store, the collector, the per-session hook event log and hook-event JSONL, and ccusage, with trend reports, a per-session report of what fired, what was blocked and the event timeline, and store pruning), known-issues (search known Claude product GitHub bugs, check service health, maintain a persistent tracked-issue registry), changelog (ingest Claude Code changelog entries and turn them into decisions: apply executes those in scope one PR per owner plugin and hands larger ones off as work items, then re-extract the native surface and file its drift as work items), prerequisites (read-only table of external binaries declared by enabled plugins; never installs), check (read-only check that node and jq resolve for the harness-ops hooks; never installs), machine-profile (discover this machine's facts and per-tree identity domains, store them as a re-runnable profile with the observation behind every value, and diff the stored profile against the host now; read-only unless the operator confirms a write, never installs and never reapplies a stored value on its own), plugins (bring a machine's plugin fleet current on demand: marketplace refresh, effective-scope updates including in-repo project/local installs, new-plugin install per policy, scope-divergence detection and explicit convergence), morning-brief (read-only gh-based operator morning view: queue-label counts, merge-ready PRs, parked decisions with their RECOMMENDED lines, and loop-lane telemetry freshness), lanes (start/restart/stop/status loop lanes as named background Claude Code sessions seeded from canonical prompt files, with per-lane model/effort, a repo-pull + marketplace-refresh launch step, and a consume-restarts action, an OS-schedulable reader that relaunches stopped lanes whose telemetry carries a restart_request), and a re-runnable setup action that settles where the known-issues registry, the skill-usage log and the hook log root live, places the root's self-ignoring guard, and detects retired conventions. Plus an opt-in, default-off per-session hook event log (one JSON line per hook event on every event the generated registry marks observable, written to <root>/sessions/<session_id>.jsonl, with SessionEnd retention by session count or age and an optional detached pre-prune command), a family of eight advisory *-audit hooks (API errors, config changes, instruction loads, permission denials, pre-compaction, skill usage, tool failures, and unsurfaced hook failures. The last also warns the user via systemMessage, since a hook that fails to launch enforces nothing and Claude Code surfaces the failure to nobody) that emit the shared hook-telemetry envelope, and a reference sink that routes envelopes under the same root: per session when the envelope carries a session id, else into the shared hook-events.jsonl the observability skill reads.",
   "author": {
     "name": "Melodic Software",
diff --git a/plugins/harness-ops/CHANGELOG.md b/plugins/harness-ops/CHANGELOG.md
index 8868b08add..0c48459fb2 100644
--- a/plugins/harness-ops/CHANGELOG.md
+++ b/plugins/harness-ops/CHANGELOG.md
@@ -3,6 +3,19 @@
 All notable changes to the `harness-ops` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [2.5.3] - 2026-10-02
+
+### Changed
+
+- **The inventory is validated against Claude Code 2.1.288.** `VALIDATED_AGAINST` moves from
+  2.1.287 to 2.1.288: every lane extracts ok, and `--reader compare` finds no value->value
+  difference between the regex and parser readers (2167 of 2167 modules parse). The parser still
+  reads the Explore and Plan `disallowed_tools` as partial where the regex reader reads them
+  literal, as on 2.1.284-2.1.287 (#5901). The one surface change is the hidden built-in `/update`
+  command, renamed `/restart` with `update` kept as an alias.
+- **The installed-build regression covers 2.1.288.** `TestInstalledBuilds` now pins the partial
+  Explore and Plan lists under the parser on 2.1.284-2.1.288.
+
 ## [2.5.2] - 2026-10-02
 
 ### Changed
diff --git a/plugins/harness-ops/skills/inventory/reference/extraction.md b/plugins/harness-ops/skills/inventory/reference/extraction.md
index decf8dc264..a9d1f477fc 100644
--- a/plugins/harness-ops/skills/inventory/reference/extraction.md
+++ b/plugins/harness-ops/skills/inventory/reference/extraction.md
@@ -473,7 +473,7 @@ Stated assumptions, not checked:
 
 | Claim | Basis | As of | Recheck trigger |
 |---|---|---|---|
-| On 2.1.284 to 2.1.287 the Explore and Plan `disallowed_tools` spread an exported array whose importers spread it, call `includes`, alias it and return it to a `.some(t)` caller whose `t` holds `!1`, re-export it, and pass it to an imported function that only calls `has`/`includes` on it. The walk follows each hop and trusts `some`, `includes` and `has`; every build has sinks for them (on 2.1.287, 189 modules with a write whose key names nothing on a target not shown fresh, 88 with a definer given such a key), and the re-exporting chunk is loaded whole, so both lists read partial under the parser | `inventory.py --binary-only` under `--reader=regex` and `--reader=parser` on each native build, compared with `compare_reports.py`: no value->value change; `test_reader_findings.TestInstalledBuilds` pins it where the builds are installed | 2026-10-02, Claude Code 2.1.287 | A run under the parser reads either list literal, or `compare` reports a value change |
+| On 2.1.284 to 2.1.287 the Explore and Plan `disallowed_tools` spread an exported array whose importers spread it, call `includes`, alias it and return it to a `.some(t)` caller whose `t` holds `!1`, re-export it, and pass it to an imported function that only calls `has`/`includes` on it. The walk follows each hop and trusts `some`, `includes` and `has`; every build has sinks for them (on 2.1.287, 189 modules with a write whose key names nothing on a target not shown fresh, 88 with a definer given such a key), and the re-exporting chunk is loaded whole, so both lists read partial under the parser | `inventory.py --binary-only` under `--reader=regex` and `--reader=parser` on each native build, compared with `compare_reports.py`: no value->value change; `test_reader_findings.TestInstalledBuilds` pins it where the builds are installed | 2026-10-02, Claude Code 2.1.287 (hop and sink counts); 2.1.288 (both lists read partial under the parser, `TestInstalledBuilds`) | A run under the parser reads either list literal, or `compare` reports a value change |
 
 ## Known non-commands
 
diff --git a/plugins/harness-ops/skills/inventory/scripts/inventory.py b/plugins/harness-ops/skills/inventory/scripts/inventory.py
index 5fd6a0b919..77afb7fc16 100755
--- a/plugins/harness-ops/skills/inventory/scripts/inventory.py
+++ b/plugins/harness-ops/skills/inventory/scripts/inventory.py
@@ -62,7 +62,7 @@
 # the skill's evals. Drift from it is not an error - the extraction is designed
 # to survive ordinary releases - but it downgrades every count from "verified"
 # to "believed", which the report has to say out loud.
-VALIDATED_AGAINST = "2.1.287"
+VALIDATED_AGAINST = "2.1.288"
 
 # Commands that have shipped in every build observed. Their absence means the
 # extraction broke, not that Anthropic deleted /help. This is the cheapest
diff --git a/plugins/harness-ops/skills/inventory/scripts/test_reader_findings.py b/plugins/harness-ops/skills/inventory/scripts/test_reader_findings.py
index fea6db9575..fed8cc433b 100755
--- a/plugins/harness-ops/skills/inventory/scripts/test_reader_findings.py
+++ b/plugins/harness-ops/skills/inventory/scripts/test_reader_findings.py
@@ -703,7 +703,7 @@ class TestInstalledBuilds(unittest.TestCase):
 
     def test_explore_and_plan_read_partial_under_the_parser(self) -> None:
         target = _require_live(self)
-        for version in ("2.1.284", "2.1.285", "2.1.286", "2.1.287"):
+        for version in ("2.1.284", "2.1.285", "2.1.286", "2.1.287", "2.1.288"):
             with self.subTest(version=version):
                 binary = INSTALLED / version
                 if not binary.is_file():
diff --git a/plugins/planning/.claude-plugin/plugin.json b/plugins/planning/.claude-plugin/plugin.json
index 183c9a8398..2c3b390826 100644
--- a/plugins/planning/.claude-plugin/plugin.json
+++ b/plugins/planning/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "planning",
-  "version": "0.62.1",
+  "version": "0.62.2",
   "userConfig": {
     "surface": {
       "type": "string",
diff --git a/plugins/planning/CHANGELOG.md b/plugins/planning/CHANGELOG.md
index 7b0f92ce5f..677833e1db 100644
--- a/plugins/planning/CHANGELOG.md
+++ b/plugins/planning/CHANGELOG.md
@@ -3,6 +3,16 @@
 All notable changes to the `planning` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.62.2] - 2026-10-02
+
+### Fixed
+
+- **The `Plan` agent verification record points at the live disallowed-tool list.**
+  `reference/native-plan-agent.md` named five tools from the 2.1.285 extraction; on Claude Code
+  2.1.288 the agent disallows nine. The record now states what that means for this skill (it
+  cannot edit files, spawn an agent, or exit plan mode) and points at
+  `builtin_agents.Plan.disallowed_tools` in the inventory instead of copying the list.
+
 ## [0.62.1] - 2026-10-02
 
 ### Changed
diff --git a/plugins/planning/skills/plan/reference/native-plan-agent.md b/plugins/planning/skills/plan/reference/native-plan-agent.md
index 6d60c97aaa..b51f9ce77f 100644
--- a/plugins/planning/skills/plan/reference/native-plan-agent.md
+++ b/plugins/planning/skills/plan/reference/native-plan-agent.md
@@ -6,8 +6,8 @@ makes it worth checking again.
 
 | Claim | Basis | As of | Recheck when |
 |---|---|---|---|
-| `Plan` is a built-in subagent described as a "software architect agent for designing implementation plans" that returns step-by-step plans | The `/harness-ops:inventory` extraction of the installed 2.1.285 binary (`builtin_agents.Plan`) | 2026-09-29 | A release renames or removes `Plan`, or changes its description |
-| It is model-invocable, gated, and on a conditional roster; Edit, Write, NotebookEdit, Agent, and ExitPlanMode are disallowed, and it omits CLAUDE.md | Same extraction: `model_invocable: true`, `gated: true`, `roster: conditional`, `disallowed_tools`, `omit_claude_md: true` | 2026-09-29 | A release changes its tools, its CLAUDE.md loading, or its gating |
+| `Plan` is a built-in subagent described as a "software architect agent for designing implementation plans" that returns step-by-step plans | The `/harness-ops:inventory` extraction of the installed 2.1.288 binary (`builtin_agents.Plan`) | 2026-10-02 | A release renames or removes `Plan`, or changes its description |
+| It is model-invocable, gated, and on a conditional roster; it cannot edit files, spawn an agent, or exit plan mode, and it omits CLAUDE.md | Same extraction: `model_invocable: true`, `gated: true`, `roster: conditional`, `omit_claude_md: true`; the current disallowed-tool list is `builtin_agents.Plan.disallowed_tools` in a fresh run | 2026-10-02 | A release changes its tools, its CLAUDE.md loading, or its gating |
 | Its documented role is research during plan mode, gathering context before a plan is presented; `CLAUDE_CODE_DISABLE_EXPLORE_PLAN_AGENTS=1` removes it | <https://code.claude.com/docs/en/sub-agents>, "Built-in subagents" | 2026-09-29 | The page changes the agent's role or how it is disabled |
 
 ## Why the verdict is complementary