chore(changelog): land entries as per-change fragments in changelog.d/

[Anarchid]

Problem

Same structural conflict generator as everywhere else in the ecosystem: every PR inserts prose at the same textual location (top of ## Unreleased in CHANGELOG.md), so any PR that outlives another merge conflicts there — full rationale in anima-research/agent-framework#128. In this repo the live case is #54, which edits CHANGELOG.md directly and is exposed to every entry that lands while it is in review.

Changes

Entries now land as one uniquely-named file per change — changelog.d/<slug>.<breaking|added|changed|fixed>.md, containing the entry's markdown bullets verbatim (slug = PR number or branch name). Distinct files never conflict in git. Same scheme as agent-framework#128, adapted:

• scripts/release-changelog.mjs — taken verbatim from the AF implementation (it is repo-agnostic; reads package.json for the version). context-manager's previous script was byte-identical to AF's previous script, so there was no repo-specific behavior to preserve. The npm version hook now folds pending fragments plus anything filed directly under ## Unreleased into the new ## X.Y.Z — date section (canonical Breaking/Added/Changed/Fixed order; fragments join existing matching subsections, including audience-qualified ### Breaking (…) headings), deletes consumed fragments, and keeps all existing refusals plus two new ones (unrecognized category suffix, non-bullet fragment).
• changelog.yml soft check passes on a well-formed new fragment or a CHANGELOG.md edit; changelog.d/README.md and badly-named fragments do not satisfy it; no-changelog label escape unchanged. Same ^src/ trigger path as before.
• publish.yml is untouched — the tag-time section guard and the github-release awk both read the assembled ## X.Y.Z section, which exists at tag time exactly as before because assembly runs pre-tag (verified below, leg 7).
• No flag day: direct ## Unreleased edits remain a supported input, merged at release time — in-flight CHANGELOG-editing PRs like feat: strategy-view composition — viewFilter, auxiliary merged slots, windowed passthrough (tune-out groundwork) #54 keep passing CI and merge normally; the entries currently under Unreleased on main stay where they are and release normally.
• CONTRIBUTING.md ## Changelog section restructured as in AF (repo-specific prose — what needs an entry, the config-becomes-required breaking guidance — kept verbatim); PR-template checkbox updated; changelog.d/README.md documents the format in-place; package.json version hook stages changelog.d; this PR dogfoods the scheme with its own fragment.
• Breaking entries now name their audience at the start of the bullet (- **Host operators:** …); the heading-qualifier form (### Breaking (host operators only)) still works via a direct Unreleased edit.

Companion to anima-research/agent-framework#128, with siblings in membrane, chronicle, and connectome-host — safe to merge in any order; each repo's scheme is self-contained.

Tests

Release script exercised on copies (bumped to 0.7.0) through the same 8 legs as AF#128; outputs pasted from the runs:

1. Clean cut — 4 fragments (breaking/added/fixed + dogfood changed) + the 4 real Unreleased entries on main (1 Added, 3 Fixed): CHANGELOG.md: released '## 0.7.0 — 2026-08-24' from 4 fragment(s) plus the Unreleased section. Fragments merged into the existing ### Added/### Fixed, new ### Breaking emitted first, ### Changed in canonical position, continuation lines preserved, consumed fragments deleted, README.md kept, fresh empty ## Unreleased on top. Exit 0.
2. Refuse-duplicate (version set to 0.6.3) — release-changelog: a '## 0.6.3' section already exists. Exit 1.
3. Refuse-empty (no fragments, emptied Unreleased) — release-changelog: nothing to release as 0.7.0 — no fragments in changelog.d/ and no entries under '## Unreleased'. Exit 1.
4. Fragments-only cut (emptied Unreleased) — clean 4-subsection section in canonical order, exit 0.
5. Refuse bad category suffix (changelog.d/oops.md) — unrecognized category — name fragments '<slug>.<breaking|added|changed|fixed>.md' so the entry is not silently stranded. Exit 1.
6. Refuse non-bullet fragment — a fragment is one or more markdown bullets ('- …'). Exit 1.
7. publish.yml tag guard + github-release awk simulated on the leg-1 assembled output for v0.7.0: guard passes (grep -Eq "^## 0\.7\.0([^0-9]|$)" matches), awk extracts a non-empty 47-line notes.md starting at ### Breaking.
8. changelog.yml grep logic simulated on six changed-file sets: src+fragment PASS, src+CHANGELOG.md PASS (legacy), src-alone FAIL, src+changelog.d/README.md-only FAIL, src+badly-named-fragment FAIL, docs-only PASS.

Not verified

A real npm version end-to-end run — the next actual release is the live exercise, same status as the existing tag-time guards. The changelog check runs live on this PR itself (satisfied by its own fragment).

---

• Changelog fragment added — changelog.d/changelog-fragments.changed.md.

🤖 Generated with Claude Code

[Anarchid]

Greptile's review of the membrane companion (antra-tess/membrane#49) found two issues in the shared code, fixed here in b5087e9: fragment validation now checks every line (top-level prose or a rogue ## heading refuses the release), and the CI check counts only added fragments (--diff-filter=A), so deleting/renaming one no longer satisfies it.

[Anarchid]

A Codex QA pass on the membrane companion (antra-tess/membrane#49, blocking) found two more shared-code issues, fixed here in 6fe1685: a fragment slug taken verbatim from a fix/foo branch name produced a subdirectory the scanner silently skipped (now fail-closed — anything that isn't README.md or a well-formed fragment aborts the release; docs prescribe / → - slugs), and indented ## headings still slipped past the line check (now a strict grammar: two-space continuations, headings/rules refused at any indent). It also asked for automated coverage: test/release-changelog.test.ts runs the real script in a throwaway directory across 18 cases, including every refusal asserting nothing is modified.

[Anarchid]

Round 2 of the Codex QA pass on membrane (antra-tess/membrane#49) — fixed here in c3253b1: refusals reported via console.error + process.exit(1) lose their stderr when stderr is a pipe on macOS (async pipes; Linux pipes are sync), so refusals now throw and the entry point sets process.exitCode = 1 and returns normally; and the grammar missed spaced thematic breaks (- - -) and headings as bullet content (- ## x), both now refused (24 regression cases). CI now also runs the suite on both OSes × Node 20/24 (it was ubuntu-only on Node 20, which is why this never surfaced).