chore[notask]: document changelog lockstep base and holepunch prettier

.agents/skills/qv-agent-stack-sync/SKILL.md

@@ -90,7 +90,8 @@ Requires explicit user confirmation of the plan (versions + which packages).
 Then for each `needs_release` package in dependency order, follow [references/prepare-cascade.md](references/prepare-cascade.md):
 
 1. Create org `release-<slug>-<version>` from `main` if missing.
-2. Prep version bump + dep ranges + changelog (`qv-sdk-changelog --package=<slug>`) + NOTICE.
+2. Prep version bump + dep ranges, then `qv-sdk-changelog --package=<slug>`
+   (follow that skill; do not call the generator as a shortcut) + NOTICE.
 3. Open **draft** release PR → `release-<slug>-<version>`.
 4. Open **draft** backmerge PR → `main` (`[skiplog]`, cherry-pick `-x`) in the same session.
 5. Skip packages marked blocked; report them clearly.
@@ -104,8 +105,16 @@ releases chain `qv-sdk-inference-version` + docs Step 8 from `qv-sdk-changelog`.
 
 1. Confirm lower dependencies are on npm (`npm view`).
 2. Fresh-install verification (below).
-3. Mark the draft release PR ready for review (and keep backmerge draft until release merges, or ready it alongside — prefer ready both when release is ready to merge).
-4. Remind: human merges; human triggers publish; then promote the next upper package.
+3. Re-run NOTICE for this package so JS can resolve. If install still fails,
+   restore the JS block from `HEAD`.
+4. Mark the draft release PR ready for review (and keep backmerge draft until
+   release merges, or ready it alongside — prefer ready both when release is
+   ready to merge).
+5. Remind: human merges; human triggers publish; then promote the next upper
+   package.
+
+The `release-<slug>-*` line is the cut. Do not cherry-pick later `main` onto it.
+Backmerge keeps `main` in sync with the cut.
 
 ## File updates (when preparing releases)
 
@@ -179,6 +188,8 @@ Always end with:
 - [ ] OpenClaw included in the cascade
 - [ ] `@qvac/inference` released ahead of an SDK release that moves major.minor
 - [ ] Draft release **and** draft backmerge opened together per package
+- [ ] Release head is `chore/<slug>-<version>-changelog`, not `release-*`
+- [ ] `qv-sdk-changelog` completed for each hop (published-tag audit included)
 - [ ] Blocked plugins (e.g. AI SDK mismatch) not force-released
 - [ ] No publish / workflow_dispatch for npm
 - [ ] Org-branch heads preferred (`tetherto/qvac`)

.agents/skills/qv-agent-stack-sync/references/prepare-cascade.md

@@ -17,36 +17,37 @@ Reuse if it exists. Do not force-push.
 ### 2. Head + metadata
 
 ```bash
-git checkout -b release/<slug>-<version> ORG_REMOTE/release-<slug>-<version>
+git checkout -b chore/<slug>-<version>-changelog ORG_REMOTE/release-<slug>-<version>
 ```
 
+Head must not start with `release-` (Merge Guard runs on the pushed ref). Full
+naming: `qv-sdk-pr-create` → "Release PR branch naming".
+
 1. Bump `package.json` (and `openclaw.plugin.json` when present).
 2. Apply planned dep / peer ranges.
-3. Changelog + NOTICE:
-
-```bash
-node scripts/sdk/generate-changelog-sdk-pod.cjs --package=<slug>
-```
-
-Author `CHANGELOG_LLM.md`, prettier-check, rebuild aggregate, announcement-post (gitignored), NOTICE. Path map: `scripts/sdk/package-paths.cjs`.
-
-4. `--package=sdk` only: `qv-sdk-inference-version` + docs Step 8 from `qv-sdk-changelog`. It
-   writes the range from a published engine version, so the `inference` release merges and
-   publishes before the SDK draft is promoted.
+3. Follow `qv-sdk-changelog` for this `--package` (lockstep `--base-commit`,
+   published-tag audit, LLM, prettier, NOTICE). Do not call the generator as a
+   shortcut.
+4. `--package=sdk` only: `qv-sdk-inference-version` + docs Step 8 from
+   `qv-sdk-changelog`. It writes the range from a published engine version, so
+   the `inference` release merges and publishes before the SDK draft is promoted.
 
-Commit `chore[notask]: release @qvac/<slug> <version>` (use `chore[bc|notask]:` when breaking). Push to `ORG_REMOTE`.
+Commit `chore[notask]: release @qvac/<slug> <version>` — no `[bc]` on the title.
+Push to `ORG_REMOTE`.
 
 ### 3. Draft release PR
 
 ```bash
 gh pr create --repo tetherto/qvac --draft \
   --base release-<slug>-<version> \
-  --head release/<slug>-<version> \
+  --head chore/<slug>-<version>-changelog \
   --title "chore[notask]: release @qvac/<slug> <version>" \
   --body "..."
 ```
 
-SDK pod template. Note future dep versions if lower npm is not live. Publish is human-gated.
+SDK pod template. Body API / Models / Breaking copied from
+`changelog/<this version>/`. Note future dep versions if lower npm is not live.
+Publish is human-gated.
 
 ### 4. Draft backmerge PR
 

.agents/skills/qv-notice-generate/SKILL.md

@@ -40,7 +40,10 @@ System requirements for Python scanning:
 1. Ask which package to generate NOTICE for (or `--all` for all packages)
 2. Source `.env` in the shell
 3. Run the generator script — this writes NOTICE files directly
-4. Only use `--dry-run` if the user explicitly asks for it
+4. If the JS scan logs `npm install failed` (or the JS section went to zero
+   deps while `HEAD` had a JS section), restore that JS block from `HEAD`.
+   Keep successful model-scan additions. Do not commit a wiped JS section.
+5. Only use `--dry-run` if the user explicitly asks for it
 
 **Do NOT commit changes.** The user will review and commit manually.