release: v5.12.2 — "Honest census" (M-BUG-1: honest plugin enumeration)

enumeratePlugins now honors enabledPlugins (disabled plugins no longer
contribute phantom agents/skills/commands) and enumerates polyrepo plugins
from their active installPath in installed_plugins.json, not only
marketplaces/<mkt>/plugins/. Fixes manifest/whats-active/AGT/token-hotspots
for any user with disabled plugins or a polyrepo marketplace. No count change
(scanners 16, agents 7, commands 21); --json/--raw byte-stable, frozen v5.0.0
+ SC-5 + default-output snapshots untouched. 1301 tests.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XYFipiVaRtbimkDjDnnKvY

CHANGELOG.md

@@ -5,6 +5,29 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [5.12.2] - 2026-06-24
+
+### Summary
+"Honest census" — fixes a plugin-enumeration bug (`M-BUG-1`, dogfooding find) that made the
+always-loaded inventory untrustworthy on two common setups: machines with **disabled plugins** and
+**polyrepo marketplaces**. `enumeratePlugins` walked `~/.claude/plugins/marketplaces/<mkt>/plugins/`
+and ignored both enable-state and the polyrepo cache layout, so it **over-counted phantom agents**
+from disabled/unenabled plugins while **missing the entire enabled polyrepo set** (whose plugins
+live under `cache/`, not `marketplaces/<mkt>/plugins/`). It now gates on `installed_plugins.json` +
+`enabledPlugins` and enumerates each plugin from its active `installPath`, with the marketplaces
+walk as fallback. Affects `manifest`, `whats-active`, the agent-listing (AGT) and `token-hotspots`
+for every such user. No new finding ID or scanner (count stays **16**, agents **7**, commands
+**21**); `--json`/`--raw` stay byte-stable and the frozen v5.0.0 + SC-5 + default-output snapshots
+are untouched. **1301** tests (+4).
+
+### Fixed
+- **`active-config-reader` plugin enumeration (`M-BUG-1`).** `enumeratePlugins(repoPath)` now honors
+  `enabledPlugins` (disabled plugins no longer contribute phantom agents/skills/commands) and
+  enumerates polyrepo plugins from their active `installPath` in `installed_plugins.json` (not only
+  `marketplaces/<mkt>/plugins/`). Real-machine verify: the always-loaded agent listing dropped from
+  114 to 104 with the phantom ghosts gone and the true enabled set present. TDD: 4 failing tests →
+  fix → full suite 1301/0, snapshots untouched.
+
 ## [5.12.1] - 2026-06-24
 
 ### Summary