[Helweg]

Release scope

Prepare 0.37.1 from the complete seven-commit / 17-file delta since v0.37.0 (573b71c3d5cfaba3a83d602f7534605047a01363) through qualified main 3c978b2ea403cc6d230964f3803a221ab55f7dde, plus the demonstrated fresh-checkout build-order correction below.

• fix: stream BM25 snapshots through atomic publication #454: stream borrowed BM25 snapshots through lease-owned atomic publication, preserving the snapshot format and generation ordering; the optional native save(destination) argument is a backward-compatible API addition supporting this fix. Keep the valid issue [Bug] indexing fails at the final save phase when the BM25 inverted index reaches ~250MB #452 reference.
• test: verify linked citation paths and ranges #453: assert linked caller-citation paths and ranges in tests.
• test: retain bounded default-root-build watcher failure diagnostics #451: retain bounded contributor failure diagnostics for the default-root-build watcher test and collect them in CI. This is not a production watcher repair or proof that a historical timeout was fixed.
• test(pi): repair real-runner prompt composition for Pi 1.3 #448: align real-runner test prompt composition with Pi 1.3; production extension/host contracts are unchanged.
• chore(deps): bump p-queue from 9.3.3 to 10.0.0 #446: update internal runtime p-queue 9.3.3 → 10.0.0.
• chore(deps-dev): bump tsup from 8.5.1 to 9.0.0 #447: update development tsup 8.5.1 → 9.0.0.
• chore(deps): bump the npm-minor-patch group across 1 directory with 4 updates #449: update locked Zod 4.6.5 → 4.6.7, Vitest/coverage 5.0.3 → 5.0.5 and typescript-eslint 8.71.1 → 8.71.2.

Synchronize all six release version values, retain an empty Unreleased changelog section, curate the complete dated release notes, clarify current tsup9 versus the retained historical scoped-tsup8 security override, and correct only the contributor development prerequisite bullet. Dependencies, override pins, public engines, exports, bins, peers, production Rust/TypeScript and test wiring are not changed by this preparation.

Demonstrated fresh-build correction and local qualification

The first fresh owned-checkout attempt failed in the real built-CLI smoke with MODULE_NOT_FOUND: root build ran TS plus the CLI smoke before the native addon existed. The failed attempt is retained. This PR fixes that root ordering to npm run build:native && npm run build:ts; it does not hide the failure with a native prebootstrap, skip the smoke, or change its assertions.

With the native addon still absent before the corrected attempt, the exact serial gate completed:

npm run build && npm run typecheck && npm run lint && npm run test:run

All four commands exited 0 on Node 26.9.0. The suite reported 143 files passed / 1 skipped; 2,828 tests passed / 6 skipped; existing skips were unchanged. Fresh Rust compilation preceded the real built-CLI smoke, which also completed through the existing pretest lifecycle.

Actual source-built consumers passed on macOS ARM64 with Node 26.9.0 and genuine official 22.13.0 (official tarball filename SHA256 verified before extraction): built CLI help; structural index/save/search/definition/update/reopen; ESM and CJS OpenCode object id/setup/server; native Rust parsing; modest 2,000-document UTF-8 streaming save/exact-score/update/reopen; and a fresh loopback-only hybrid index/search/update/reopen exercising actual p-queue calls. Each runtime observed 16 processes / 15 successful loads of the same native addon; each bounded embedding server observed 11 requests / 19 inputs / maximum batch 2 and exited 0. These are plumbing/compatibility checks, not retrieval-quality or stress results.

A later private inventory verifier used an overly strict all-files-nlink=1 assertion. Its failed receipt is retained: ordinary esbuild postinstall created two inode pairs, each with exactly two distinct members fully within this one owned installation. All link counts are accounted; no shared/external hardlink or escaped symlink exists, and the native addon has nlink 1. The verifier correction required no product change, package mutation, or gate/smoke rerun.

Compatibility and security snapshot

• Published consumer floor remains Node >=22.13.0; p-queue10's >=22 engine fits that floor. New upstream timer validation rejects custom requestIntervalMs > 2147483647 (previously Node overflow-clamped such timers to 1ms). No claim that every possible input is unchanged, and no extra validation/production change is made here.
• Development support is ^22.19.0 || ^24.11.0 || >=26.0.0, recommending Node 24.11+ LTS. This development-only tooling floor does not raise the published engine floor; no developer suite was run on unsupported Node22.13 tooling.
• Qualified main push CI 39404851057 had all 8 jobs successful; dynamic analysis 39404850620 had all 4 jobs successful. Release-PR checks are separate and must pass on this PR's final head.
• At 2026-10-20 11:24:16–17 UTC, complete open Dependabot, code-scanning and secret-scanning boards each returned HTTP200 and []. This is a dated snapshot, not a permanent security assertion; post-merge refresh is still required.

Release boundaries

Only local macOS ARM64 source-built runtime behavior has been exercised so far. No Linux/Windows execution, original 250MB/OOM reproduction, historical watcher fix, frozen comparison/regrade, retrieval-performance claim or baseline update is asserted. Held draft #450 is not merged or waived.

This PR does not claim npm publication, registry-installed package behavior, publisher-native outcomes, npm provenance, or normal-profile published OMP proof. Those require the later explicitly gated release/publication and independent clean verification of both package identities, including Node22.13 and native OMP. Merge, tag and publication remain separately gated.