You can ship a feature that looks tested and isn't. April 20 was two coordinated answers to that problem. On one front ( claude-code-slack-channel ), the bot-manifest protocol's publish side landed — the second half of a protocol whose consumer side had shipped on April 19. The same repo set a Stryker mutation baseline, killed the top-5 mutation survivors on its security primitives, and added a TypeScript-aware cyclomatic-complexity gate to CI. On another ( claude-code-plugins ), mass-publish infrastructure for the npm catalog scaffolded — scaffold-every-package-json generator, mass + incremental publish workflows, a SIGPIPE fix for the enumerate step. The narrative thread is the same across both: don't trust that something works until an adversarial check tries to prove it doesn't. The bot-manifest publish side — Epic 31-B Context from the day before: claude-code-slack-channel is an MCP server that lets Claude Code operate inside a Slack thread.…