chore(release): 0.44.3

CHANGELOG.md

@@ -26,6 +26,9 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+
+## [0.44.3] - 2026-08-07 — Quorum stall-window derivation, no shipped user config, and migration/portability guards
+
 ### Fixed
 - fix(install): **`--migrate-slots` no longer renames a live Daintree preset slot.** `SLOT_MIGRATION_MAP` treats `claude-minimax` / `claude-kimi` / `claude-glm` as legacy *model*-based names, but that is also exactly the shape `/nf:link-daintree` produces today (`{agentName}-{slug(preset.name)}`) — so a working preset clone could carry a name the map wanted to rename. The rename moved the `mcpServers` key to `claude-2` while `providers.json` still said `claude-minimax`, orphaning the provider entry and deleting the `mcp__claude-minimax__…` tool the quorum dispatches to. Preset clones are identifiable (link-daintree stamps `daintree_preset_id`) and are now skipped, with the skip reported rather than silently folded into "already migrated". Two further hardenings on the same path: a rename that *does* apply now updates `providers.json` in lockstep instead of leaving a dangling pair, and provider resolution goes through `resolve-providers.cjs` (issue #197) rather than an inline path. Fails open when `providers.json` is absent or corrupt — the pre-slot install this migration exists for has none. 4 tests, mutation-proven red in both directions (guard removed → a preset slot is renamed; lockstep removed → the pair dangles).
 - fix(scripts): **`scripts/tui-*.tape` no longer hardcode the maintainer's home directory.** Both shipped to npm containing `cd /Users/jonathanborduas/code/QGSD`, a line nobody else can execute. They now use `cd ${NF_REPO:-$PWD}` (verified against real `vhs`: with `NF_REPO` set the `cd` takes effect, and unset it falls back to the shell's cwd, which vhs sets to its own), `npm run assets:tui` exports `NF_REPO="$PWD"`, and `scripts/*.tape` drops out of `package.json` `files` — asset-generation tooling is not part of what users install, the same reasoning that already excludes `scripts/generate-*-svg.js`. New `lint-isolation` Rule 8 (`machine-specific-path`) gates the class: no `/Users/<name>/` or `/home/<name>/` path in a file that is *executed as written* (`.tape`, `.sh`, `.yml`/`.yaml` under `scripts/` and `.github/workflows/`) — the same defect that once broke `benchmark-sync.yml` in CI. Scoped to those formats so illustrative paths in JS comments stay legal, with comment lines and obvious placeholders (`/Users/foo/`, `/home/<name>/`, `/home/runner/`) exempt. 5 tests in `bin/machine-path-lint.test.cjs`, including one asserting the rule is actually *invoked* and not merely defined; mutation-proven red.