Prepare for tinycloud 0.3.18: sites embed v8–v12 — the live-site elements (skill floor → 0.3.18)

[kdr]

Summary

Prepares the distribution surfaces for tinycloud 0.3.18, a sites-embed parity + publish-guard release (no new verbs, flags, or feature ids — verbs stay 17, features stay 42). The Cloudglue-served sites embed script moved from v7 to v12, and the skill now teaches the full surface:

• v8 — split delivery: /__cg/embed.js core + lazily-loaded /__cg/embed-live.js live chunk. No author-facing change; docs warn generators never to emit the chunk themselves.
• v9 — live-element tuning: <cg-chat instructions> (per-site system prompt) + built-in Stop; <cg-search scope modalities label-filters threshold limit group-by sort-by>; streamed <cg-deep-search> + exclude-weak-results; <cg-face-search threshold limit> with bounded face-hit moments.
• v10 — composability: ::part() styling hooks on every live panel; cg-results/cg-answer/cg-error + cancelable cg-resultopen/cg-citationopen host events.
• v11 — <cg-query>: natural-language analytical questions answered as an inline table with the compiled SQL shown (the site-side face of the query verb's engine; point it at an entities/metadata collection).
• v12 — <cg-transcript>: click-to-seek speech turns that follow a bound player (unbilled); <cg-chapters auto>: self-populating chapters (the auto attribute makes the otherwise public-safe element private-site-only).

Binary-side change shipping in 0.3.18: tinycloud publishhard-rejects<cg-query>, <cg-transcript>, and <cg-chapters auto> on a public site (explicit-children <cg-chapters> stays public-safe).

Changes

• skills/tinycloud/reference/verbs.md — the live-components section rewritten for v8–v12 (per-element attributes, parts/events, window.cloudglue client, guard scope)
• skills/tinycloud/reference/glossary.md, skills/tinycloud/SKILL.md — live-components entries expanded
• Skill floor → 0.3.18 (tinycloud-skill.json min_version/supported_range + preflight.sh; REQUIRED_FEATURES unchanged) — the skill teaches the new elements and relies on the extended publish guard
• package.json, .claude-plugin/plugin.json, .claude-plugin/marketplace.json → 0.3.18
• README.md — version examples → 0.3.18; publish row mentions the live elements
• CLAUDE.md — 0.3.18 paragraph appended to the binary-contract history; stale "live CDN serves 0.3.14" CI note corrected to 0.3.17 (current reality)

Verification

• npm test — 42/42 against the offline fixture CDN
• TINYCLOUD_TEST_TARBALL=<real 0.3.18 darwin-arm64 tarball> npm test — 42/42
• TINYCLOUD_CMD=<extracted 0.3.18 binary> EXPECTED_VERSION=0.3.18 scripts/smoke-test.sh — all pass
• shellcheck + claude plugin validate . clean
• Live proof with the 0.3.18 binary (built from the private source repo): a public kitchen-sink site (playback elements + OG tags) at https://autumn-butterfly-6491.cloudglue.site plays in-browser; the private kitchen-sink page (every live element wired) is rejected on --visibility public by the new guard and published private to https://red-bread-0935.cloudglue.site; the sites edge already serves embed v12 + embed-live.js

Merge gate

⚠️Merge only after CDN channels.stable = 0.3.18 (the 0.3.12/0.3.14–0.3.17 floor-raise pattern): the raised preflight floor would otherwise fail against the live CDN's 0.3.17.

---

Note

Low Risk
Docs and version metadata only in this repo; risk is mainly operational—merging before CDN stable is 0.3.18 would fail skill preflight for users on 0.3.17.

Overview
Prepares the public distribution repo for tinycloud 0.3.18 (npm package, Claude plugin metadata, README examples) and raises the skill compatibility floor from 0.3.17 to 0.3.18 in tinycloud-skill.json and preflight.sh (required_features unchanged).

Agent-facing docs now teach the sites embed v8–v12 live surface: lazy /__cg/embed-live.js loading (authors still only tag /__cg/embed.js), richer <cg-chat> / <cg-search> / <cg-deep-search> / <cg-face-search> attributes, ::part() styling and host events (v10), <cg-query> (v11), and <cg-transcript> plus <cg-chapters auto> (v12). SKILL.md, reference/verbs.md, and reference/glossary.md were expanded accordingly; README.md’s publish row notes private-site live elements.

CLAUDE.md adds the 0.3.18 contract paragraph (embed parity + publish hard-rejecting<cg-query>, <cg-transcript>, and <cg-chapters auto> on public sites) and updates the CI note that the live CDN currently serves 0.3.17. Merge is gated on CDN channels.stable = 0.3.18 so the raised preflight floor does not break installs against an older stable channel.

^{Reviewed by Cursor Bugbot for commit 14723f5. Bugbot is set up for automated code reviews on this repo. Configure here.}