release-notes: draft for the next dotfiles-Windows release

[github-actions]

release-notes: draft for the next dotfiles-Windows release — 2026-07-09

I have everything I need. Here's the drafted release notes.

---

Release notes draft — dotfiles-Windows

Range: v1.1.0..HEAD (39 commits). Last CHANGELOG heading is v1.1.0 (2026-06-29); the tag line has drifted to v1.1.6 via auto-tag's mirror-sync patch-bumps — so everything since the v1.1.0 heading is unreleased human-facing news. The existing [Unreleased] block is the already-curated half; the block below folds it together with the perf/CI/fix work the commits add but [Unreleased] doesn't yet mention.

🏷️ Release headline

A per-prompt latency overhaul (≈1.8s → ≈0.28s), a hardened CI supply chain, and the release-automation twins — plus the git-hang and paste-safety fixes.

📋 Ready-to-curate block

## [v1.2.0] - 2026-07-09 — Shell latency + CI hardening

### Added

- **`/release-readiness` + `/release-notes` routines** (`.claude/commands/` +
  `.github/workflows/claude-routines.yml`). The Windows twin of Core's release
  routines: `release-readiness` files a go/no-go verdict with a recommended next
  version (built for Windows' `auto-tag` patch-bump drift); `release-notes` drafts
  the CHANGELOG entry. Both report-first. **Inert by default** — dormant until a
  `CLAUDE_CODE_OAUTH_TOKEN` repo secret is added.

### Changed

- **Interactive-shell latency overhaul** (`core/10-tools.ps1`) — full per-prompt
  render measured **~1.8s → ~0.28s** on the Windows host. Cache starship
  `--print-full-init` (the old init cache was a no-op for the one tool it mattered
  most for, re-spawning starship every shell); default PSReadLine `PredictionViewStyle`
  to `InlineView` to stop the per-keystroke dropdown redraw (`DOTFILES_PSRL_LISTVIEW=1`
  restores it); keep full `mise activate` with a `DOTFILES_MISE_SHIMS=1` escape hatch.
- **PSFzf lazy-loaded off the shell-render path** — `Import-Module PSFzf` (~260ms, the
  biggest single slice of tool init) now defers until the first `Ctrl+T`/`Ctrl+R`
  press via lightweight stub handlers, threaded through the atuin `Ctrl+R` handoff.
- **psmux split cold-start cut** — in a split, `Get-InitCache` takes a validated
  fast-path (cheap generator-hash check, skips the ~60ms/tool exe+mtime probes) and
  `mise` uses `--shims` (261ms → 16ms warm). **Behavior change:** `psmux.conf` flips
  `warm on` + `destroy-unattached off` so the warm standby server can spawn — detached
  sessions now persist and can pile up (manage via `psmux ls` / `kill-session`).
- **CI supply-chain hardening** — notify-web dispatcher mints a short-lived
  fleet-scoped GitHub App token (falls back to `WEBHOOK_SECRET`); scheduled/tag
  workflows are owner-gated; Dependabot migrated to the shared Renovate preset.

### Fixed

- **Runaway `git.exe` processes that blocked updating git.** New early fragment
  `core/08-git-safety.ps1` exports `GIT_TERMINAL_PROMPT=0` + `GCM_INTERACTIVE=Never`
  so shell-spawned git fails fast instead of blocking forever on an unanswerable auth
  prompt; adds a `git-reap` (`Reset-StuckGit`) verb to kill an existing pile. Escape
  hatch `DOTFILES_GIT_ALLOW_PROMPT=1`.
- **Large multi-line pastes no longer switch modes / run vim commands.** Bumped the
  `PSReadLine` pin (`packages/modules.ps1`) to `2.3.6` for bracketed-paste support,
  kept Vi mode, and added a `< 2.2.0` self-diagnosing floor guard (asserted in tests).
- **Windows nvim plugins now pinned to Core's `lazy-lock.json`** — `nvim-sync.ps1`
  stopped excluding it, so Windows nvim no longer floats on plugin HEAD; the nvim
  parity gate now covers it.
- **Profile load-tracer repaired** — an empty-`List` truthiness bug swallowed the trace.
- **`git-reap` now surfaces `Stop-Process` failures** and declares `SupportsShouldProcess`.

### Documentation

- **README rebuilt as a lean showcase landing page** and given a second-pass polish
  (versioned shields tracking `dotfiles-core`, docs-hub links, Languages/Tools).
- **`aliases.md` gap-fill** — documented `psmux-pill`/`maint`/`doctor`, plus crypto,
  help, diagnostics, and keybindings sections; filled the matching `CLAUDE.md` gaps.
- **Added a LICENSE.**

### Housekeeping

- Core mirror-syncs (nvim/starship up to v3.2.0), scoop/winget lock re-pins, action
  bumps, org migration `Gerrrt` → `dotgibson`, and internal refactors (hoisted
  `Test-InMux` / shared `Test-InteractiveShell` into `05-lib`).

✏️ Editorial pass

• User-facing news (drives the value story): the latency overhaul, PSFzf lazy-load, the git-hang fix, and paste safety — these are what a daily driver feels.
• Internal plumbing (real, but lower down): CI hardening (App token, owner-gating, Renovate), the release routines (inert until a secret lands), and the refactors. Folded or grouped so they don't crowd out the shell-experience story.
• ⚠️ Behavior change to surface loudly: the psmux warm on / destroy-unattached off flip means detached sessions now persist and can accumulate. Not a code-contract break (no removed module export), so it doesn't force a major — but it changes steady-state behavior a user will notice, so it belongs above the fold with the management commands (psmux ls / kill-session) spelled out. There are otherwise no breaking API/export removals in this range.
• Version recommendation: v1.2.0 — net-new features (release routines, CI App auth) + a substantial perf pass, no export removals → minor. Confirm against /release-readiness before cutting; the last tag is already v1.1.6, so the next tag must be ≥ v1.1.7 regardless — v1.2.0 clears it and reflects the scope.

Report only — I have not edited CHANGELOG.md or cut a tag. The bullets above are raw material; curate the rationale prose (especially the psmux trade-off) before pasting under [Unreleased].

Filed by the claude-routines workflow. Report-first: review and act — nothing was changed.