Ask Orbit how to sharpen a hand plane and it recommended a Braze packager, said you were ready to proceed, and graded itself 100
orbit_route_task is the front door — you describe a job, it picks the skill. It could not say "I don't know" to anyone who had finished setup. A platform read out of your config was worth +8 against a match floor of 6, so the floor was already cleared before your request was scored at all, and a woodworking question came back as braze-build-packager with a self-graded 100/sharp. Remove the config and the same question abstained correctly, which is the tell: the router's honesty was a function of your settings rather than your words. Three more leaks sat underneath it, all of them ways for noise to pay out. Scoring is now split into what the request earned and what the config contributed, and the floor filters on the request alone — config can reorder candidates that already qualified, never invent one. Sourdough, Kubernetes, Lisbon weather and a hand plane all abstain now. Orbit's own flagship pitch reaches template-brain, which it always could, once it stopped being outscored by noise.
What shipped
•Bug fix — the router can abstain again. no_strong_match was unreachable for any configured install, which meant two people asking the identical question got different answers depending on a file neither of them mentioned. The merit/context split fixes the class, not the instance: a bonus that did not come from your request can no longer lift a candidate over the floor.
•Three more scoring leaks, each one a way to be paid for a coincidence. Sequence matching ran on String.includes, so "failing alignment" contains "ai" and pulled the AI-personalisation sequence for a flat +9. Phrase coverage scored a single word by substring anywhere inside a trigger phrase. And a flat +2 per shared keyword paid out on words like "any", which appears in 54 of 83 skills. Keywords are now weighted by rarity against a corpus derived at run time, function words are excluded on grammatical grounds rather than by a hand-kept list, and sequence matching respects word boundaries.
•The routes that already worked still work. The Braze win-back and the first-message welcome email both resolve as before — a router that abstains on good requests would have been a worse bug than the one being fixed.
•Bug fix — the artifacts Orbit composites in dark mode carried the light logo. icon-dark.png was byte-identical to icon.png, so the dark variant of a lifecycle diagram, PDF or export header composited a mark built for a white ground onto a near-black one. It is a real variant now: the indigo tile goes near-black, the mark stays white, 19.46:1 against the dark theme background. Separately, the markdown header Orbit writes above a report linked the website’s dark-INK mark, which is legible on white and invisible on a dark page — it now uses the full tile, which carries its own background and reads either way.
•Setup fix — SETUP.md leads with the command that needs no credentials at all. It opened with a 24-flag registration line, which reads as a wall of prerequisites for a product where skill routing, template loading, the validators, lifecycle diagrams and workspace bootstrap all run with nothing configured. The long form is still there, below, with every flag marked optional.
•The two privacy docs have two names. Both have shipped inside the extension since 0.33.0, and "the privacy doc" was a coin flip between them — docs/PRIVACY.md is now docs/IMAGE-GENERATION-PRIVACY.md, which is what it always was: the Gemini art-layer page. The telemetry disclosure is PRIVACY.md at the root, and every pointer now says which one it means.
•Bug fix — an imported Figma file or PDF no longer appears twice inside its own untrusted-content fence. A section's preview text is derived from the same source as its extracted text, and both were appended, doubling the quoted region for no extra coverage.