diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json
index 470c59f..1021bd3 100644
--- a/.claude-plugin/marketplace.json
+++ b/.claude-plugin/marketplace.json
@@ -6,14 +6,14 @@
   },
   "metadata": {
     "description": "Sovereign, decay-aware memory for AI coding agents on Arkiv. Your sessions become a memory your agent owns.",
-    "version": "0.1.2"
+    "version": "0.1.3"
   },
   "plugins": [
     {
       "name": "cortex-memory",
       "source": "./cortex-plugin",
       "description": "Every Claude Code session becomes a memory node: auto-captured before the context compacts and written to Arkiv (wallet-encrypted), recalled at session start so you never re-explain your project. Adds the cortex_recall / cortex_act / cortex_store_document / cortex_summarize_session MCP tools and a recall→cite→store working-agreement skill.",
-      "version": "0.1.2",
+      "version": "0.1.3",
       "keywords": ["memory", "arkiv", "recall", "sovereign", "agent-memory"]
     }
   ]
diff --git a/.github/workflows/dist-check.yml b/.github/workflows/dist-check.yml
index ce5e98c..f4ac18d 100644
--- a/.github/workflows/dist-check.yml
+++ b/.github/workflows/dist-check.yml
@@ -24,14 +24,22 @@ jobs:
       - uses: actions/checkout@v4
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: latest
+          # Pinned: a different bun minifier emits different content-hashed
+          # filenames for the dist/connect web assets, which made every run red
+          # (false "stale" on a file-rename diff) — alarm fatigue that would mask
+          # a real stale-dist regression. Keep in sync with local bun.
+          bun-version: "1.3.3"
       - run: bun install --frozen-lockfile
       - name: Rebuild plugin bundles
         run: bun run build:plugin
       - name: Fail if committed dist is stale
         run: |
-          if ! git diff --exit-code -- cortex-plugin/dist; then
+          # Guard the five RUNTIME bundles (hooks, drain, auth, mcp) — the code
+          # marketplace installs actually execute. dist/connect/* are content-
+          # hashed browser assets whose filenames vary across bun builds; a
+          # rename there is not staleness, so exclude them from the diff.
+          if ! git diff --exit-code -- cortex-plugin/dist ':(exclude)cortex-plugin/dist/connect'; then
             echo "::error::cortex-plugin/dist is out of date with src. Run 'bun run build:plugin' and commit the result."
             exit 1
           fi
-          echo "✓ cortex-plugin/dist matches a fresh build from src."
+          echo "✓ cortex-plugin/dist runtime bundles match a fresh build from src."