release: prepare 1.7.3 squash inheritance fix

[MongLong0214]

No-Issue: a release preparation and a dependency policy decision, neither of which was filed as an issue

Two commits:

1. @types/node stays on the supported runtime floor. engines.node is
   >=22.23.2 and the dependency is pinned ^22.10.0. Dependabot's 22 → 26
   major bump (chore(deps-dev): bump @types/node from 22.20.1 to 26.6.3 #1151) typechecks cleanly, which is the problem: types from a
   later major admit APIs node 22 does not have, and the type checker is the
   only thing that would refuse them. A major bump here is a decision about the
   support floor, made by hand next to engines, so the ignore rule says so
   rather than leaving a pull request to be closed unread every month. Minor and
   patch updates inside the major still arrive; a security advisory ignores the
   block entirely.

2. Release 1.7.3. 59 version pins across eleven files, measured rather than
   recalled, plus the CHANGELOG entry. The lockfile fields are set by parsing
   JSON, and nothing else in the tree still names 1.7.2 except the CHANGELOG's
   own ## 1.7.2 heading, which is that release's section and stays.

What ships: the #1153 squash-inheritance fix, @modelcontextprotocol/sdk
1.30.1, js-yaml 5.4.2 (dev), and docker/setup-qemu-action v4.4.0 in CI.

Verification

• test/manifest.test.ts, test/readme.test.ts, test/release-version.test.ts
  — 115 tests, green, which is the surface that pins the version strings.
• Full suite green on this content before the bump (212 files, 4614 tests).

dist/ is absent on purpose: canonical-merge.yml rebuilds it and regenerates
the manifest.

[github-actions]

CommitLore — record lint

Trailers: clean — 2 commits in origin/main..9c88c0ced5850ef0c63bb222b5360517abe97992
Active constraints: 252 limits · 409 ruled-out · 112 warnings — from 269 records over 13 changed paths

Active constraints for the paths this PR touches

Limits (252)

• r-typesnodefloor b59adb6 — engines.node is >=22.23.2 and @types/node is pinned ^22.10.0, so the types track the oldest supported runtime rather than the newest that exists
• r-2fb1c649b3ad 922f95f — 새 ip-address advisory가 기존 production audit gate를 실패시켜 이번 릴리즈에 compatible transitive patch가 필요하다.
• r-3081e462f9b8 3b2fd09 — canonical-merge publication의 force push가 승인 조건과 충돌하여 공식 pinned builder로 artifacts를 만들고 일반 PR로 제출한다.
• r-ef0defcd69a8 11ef133 — the previous version occurs 62 times across twelve files on main; 59 are install pins and manifest versions and moved, and the three that stay are CHANGELOG.md's 1.6.0 heading and the lockfile's sourcemap-codec version and tarball URL
• r-276fed4dac2b d71a55c — after the bump the only occurrence of the previous version is CHANGELOG.md's own 1.5.1 heading, which is that release's section and must not move; the other 59 across eleven files are install pins and manifest versions
• r-release151 94e85f9 — two occurrences must not move and were read rather than filtered -- CHANGELOG.md carries 1.5.0 as its previous heading, and docs/adr/ADR-0009 carries gitlore@1.5.0, which is a different package's version and a coincidence of numbers
• r-release150 df9fe0d — enforcement exists only where a Bash PreToolUse hook does; a person at a terminal, CI, a script and every host without that hook get a simpler command and no gate
• r-release150 df9fe0d — the trivial thresholds are chosen rather than measured, and are not configurable in this release -- a trivial block in the policy would move policy_identity_hash and invalidate every binding and pending transaction in flight
• r-release142 208b821 — the version pins moved across 11 files; installer/canonical-artifact.json is regenerated by the canonical build and is deliberately not among them
• r-mcpdualrole1056 4b7a8aa — the new guard asserts the absence of one exact filename, because the filename is what the project loader keys on; a host that reads project-scope MCP configuration under some other name is not covered by it
• r-mcpdualrole1056 4b7a8aa — commitlore init still writes a project-scope .mcp.json into user repositories, and running it in this checkout recreates the file -- gitignored now so it cannot be committed again, but the product-side removal is not in this commit
• r-mcpscopes1 d2741f3 — claude mcp get answers whether the host knows the name, not at which scope, so already-registered can be reported for an entry made at a different scope than the one asked for; the line says so and points at claude mcp list
• r-mcpscopes1 d2741f3 — the host-owned path is exercised against a stub named claude on PATH, which pins the argv and the two exit-code shapes but not the real CLI's behaviour on any particular version
• r-mcpscopes1 d2741f3 — a machine with no claude reports at 0 with the command to run later, so a user scope that never took effect looks the same in the summary as one that was never asked for
• r-treebind1030 ad4c4ef — the argument is optional, so a caller that does not pass it binds to the server's checkout exactly as before -- this closes the silent case only for callers that say what they meant
• r-treebind1030 ad4c4ef — the assertion compares working trees, so a server and caller in the same tree at different times are indistinguishable; HEAD moving under a prepared transaction is still the receipt's job (r-requirereceipt1005)
• r-treebind1030 ad4c4ef — commitlore capture on the CLI is unchanged and needs no assertion, because it binds to its own working directory -- only the MCP surface can disagree with its caller
• r-readmeaccuracy140 ba745bf — the four translations were changed by matching the same passages, not by re-reading each in full, so a claim wrong only in one language is not covered here
• r-readmeaccuracy140 ba745bf — the assertions checked are the ones a command or a file can answer -- prose about what the product is for is not checkable this way and was left as written
• r-measurewrites988 4edfd9f — dbstat is a SQLite compile option, and the harness prints an empty table rather than failing where it is absent -- an empty table there means the measurement did not run, not that the cost is zero
• r-measurewrites988 4edfd9f — a bare npx vitest run still reads whatever dist/ is on disk; only the two documented commands build first, and nothing but a paragraph in CONTRIBUTING guards the third
• r-buildbeforetest960 346006a — npm test and a bare vitest run are untouched, so the same trap is still open for anyone who reaches past the documented command -- CI builds explicitly, which is why that is tolerable rather than fixed
• r-believablesuite960 3ee700c — the harness reverses one hunk at a time, so a fix spread over two hunks that only fails together reads as two unguarded changes
• r-believablesuite960 3ee700c — 120s is a measurement from one machine; a slower one needs its own number rather than this one inherited
• r-pinnedmirror957 a06b984 — a note's own block still costs a process each, because %(trailers) parses the annotated commit's message and there is no atom for a note body
• r-pinnedmirror957 a06b984 — the reachability filter still reads HEAD at listing time, so a HEAD that moves mid-pass can still change which notes are in scope; only the mirror is pinned here
• r-probeconsumers975 adcbd50 — the block cache lives on CollectCache and therefore for one invocation only -- hoisting it to module scope would serve a rewritten message from memory, which is the staleness r-staleonepass names
• r-probeconsumers975 adcbd50 — doctor still spends 71 parses against a complete index, through its own short per-branch ranges; batching within a range trades N parses for one batch and a short range has few, so the batch has to span ranges to help there
• r-monotonic968 8f5ee12 — two unbudgeted rebuilds racing still overwrite each other, and repeated replacement can still keep a drain from converging -- neither is closed by this
• r-monotonic968 8f5ee12 — the comparison is inside the write transaction and the scan is not, so a rebuild can still do the whole scan and then discard it; what it cannot do is publish it over something better
• r-probebatch951 8d78b62 — the equivalence is proven over this repository's 114 candidate paragraphs and sixteen constructed shapes, not over every paragraph git can parse -- the two shapes that broke the first design were both outside the first corpus
• r-probebatch951 8d78b62 — one temp directory per call, removed in a guarded finally; a process killed with SIGKILL leaves it for the operating system
• r-probebatch951 8d78b62 — the batch shares an answer between identical paragraph texts within one call, which holds only while git's configuration is fixed for that call
• r-atomreuse951 eb2869d — the saving is one process per message that reaches the recovery pass, so a history with no multi-block messages sees no change at all -- 20,000 generated commits spent zero interpret-trailers before this and spend zero after
• r-atomreuse951 eb2869d — atomIsAmbiguous still sends a message to the process, so the count is bounded by the framing of real messages rather than by a rule
• r-resume951b 3c1412d — the notes mirror is revalidated inside the transaction, which refuses stale work rather than merging it -- a drainer that loses the race discards what it read and the next call repeats it
• r-resume951b 3c1412d — the concurrent orderings are argued from the transaction boundary and reproduced by injecting the interleaving at a clock reading, not by running two processes
• r-resume951 83f5629 — the drain reads one batch before its deadline may cancel anything, so a call can overshoot its slice by one batch -- without that floor a batch costing more than the slice is cancelled every time and the queue never drains at all
• r-resume951 83f5629 — a note's body is still read through the live ref after the mirror was listed from it, so a single invocation can cross a notes update; the queue now carries its originating ref, which closes the resumed case and not that one
• r-resume951 83f5629 — the equivalence is proven on this repository and on synthetic histories of 400 commits, not over every repository shape
• r-changelogprose 84dcf58 — the entry states the added cost because the fix is slower, and a changelog that reports only the wins is a sales document
• r-release1219 6fd1ed5 — the pin count is a property of this tree and grows with each README section, so the next release measures it rather than reusing 59
• r-release1218 3ba5d09 — the pin count is a property of this tree and grows with each README section, so the next release measures it rather than reusing 59
• r-changelogmood e619a0d — the entry now describes the rule rather than its history; the two commits carry why it changed
• r-release1217 4836a95 — the pin count is a property of this tree and grows with each README section, so the next release measures it rather than reusing 59
• r-release1216 573d14c — the pin count is a property of this tree and grows with each README section, so the next release measures it again rather than reusing 59
• r-release1215 b6d2cfe — the pin count is a property of this tree; the surface grows with each README section, so the next release must measure it again rather than reuse 44
• r-recipecannotrun926 6445ac3 — the row checks that cli-path is supplied, not that the path it names exists in the runner -- a checkout step that lands elsewhere still reads as wired
• r-recipecannotrun926 6445ac3 — a repository that references the action from a job which never triggers still reads as protected
• r-occupiedcheckout922 059e200 — the adoption path verifies the runtime manifest and the requested tag, which is what the reuse path checks -- it does not prove the two processes wrote identical bytes
• r-occupiedcheckout922 059e200 — the reconciling line fires on any non-zero installer exit whose state nevertheless verifies, so an unrelated installer error reads as "a step was abandoned" too
• r-release1214 6e91b8e — dist/ is not rebuilt here -- the canonical bundle is rebuilt on linux/amd64 by canonical-merge.yml, and a macOS esbuild output would not match CI
• r-release1213 86f6dab — dist/ is not rebuilt here -- the canonical bundle is rebuilt on linux/amd64 by canonical-merge.yml, and a macOS esbuild output would not match CI
• r-squashdiscovery915 b085e7f — this reports whether a workflow references the action, not whether that workflow is correct -- a job missing fetch-depth: 0 or the notes fetch references it and still cannot preserve anything
• r-squashdiscovery915 b085e7f — a non-GitHub host that squashes is reported ok, because there is no action for it; the detail says that rather than claiming coverage
• r-release1212 0e93f7c — dist/ is not rebuilt here -- the canonical bundle is rebuilt on linux/amd64 by canonical-merge.yml, and a macOS esbuild output would not match CI
• r-release1211 24dbdcf — dist/ is not rebuilt here -- the canonical bundle is rebuilt on linux/amd64 by canonical-merge.yml, and a macOS esbuild output would not match CI
• r-release1210 da1cc9f — dist/ is not rebuilt here -- the canonical bundle is rebuilt on linux/amd64 by canonical-merge.yml, and a macOS esbuild output would not match CI
• r-release129 276feed — dist/ and installer/canonical-artifact.json are absent by design, so artifact:verify fails on this tree -- canonical-merge.yml rebuilds them on linux/amd64
• r-release128 795791c — dist/ and installer/canonical-artifact.json are absent by design, so artifact:verify fails on this tree -- canonical-merge.yml rebuilds them on linux/amd64
• r-release127 ba88444 — dist/ and installer/canonical-artifact.json are absent by design, so artifact:verify fails on this tree -- canonical-merge.yml rebuilds them on linux/amd64
• r-honoadvisory d339291 — this repairs one resolution rather than the class -- the next advisory in a transitive production dependency will block a release the same way, and nothing here notices earlier
• r-release126 55e8d79 — dist/ and installer/canonical-artifact.json are absent by design, so artifact:verify fails on this tree -- canonical-merge.yml rebuilds them on linux/amd64, where a macOS esbuild output would not match
• r-release125 9d03977 — dist/ and installer/canonical-artifact.json are not in this commit, so artifact:verify fails on this tree by design -- canonical-merge.yml rebuilds them on linux/amd64, where a macOS esbuild output would not match
• r-reviewcaughtserverjson c7debaf — the gate now reads server.json's .version; the installer command and release URL inside it are strings nothing compares, exactly as the four READMEs and two installers are
• r-release121 9845d44 — npm audit is a claim about advisories published now, not about the code; and the canonical build was reproduced on one machine against the pinned image digest, which CI repeats twice but no one has repeated on another date
• r-depsbatchbump 42013a6 — says nothing about behaviour changes inside SDK 1.30.0 itself; the suite covers this repository's use of the SDK, not the SDK
• r-fasturiqsaudit 1752273 — an audit is a claim about advisories published at this moment, not about the code; a clean run says nothing about tomorrow's disclosures
• r-cdebremoval 36ae3ab — four documents still mention CDEB and are deliberately kept -- ADR-0033, the archived readiness SSOT, an archived handoff, and two CHANGELOG lines. They are the record of decisions that were made, and rewriting them would be deleting evidence rather than code
• r-cdebremoval 36ae3ab — one full-suite run in the middle of this work reported a single failure that the next two runs did not reproduce, with no relevant change between them. Its name was not captured before the output was discarded, so it is recorded as an unidentified flake rather than as something this commit fixed
• r-v5stage1r1reviewfixes 87cacec — the pilot-gate custody gap is open and needs role separation -- execution, custody of arm-coded outcomes, and continuation held by different parties. That is an owner decision and it has to be settled before the pilot, not after
• r-v5stage1r1reviewfixes 87cacec — the firewall now names who produced the maintenance need and refuses a producer not declared record-blind, but a declaration is not evidence. Making it evidence needs an attestable isolated authoring environment this layer does not have
• r-v5stage1r1reviewfixes 87cacec — tau_squared_bound = 0.06 is a frozen assumption, not a measurement. It is conservative in the direction that matters -- lower true heterogeneity means the study detects more than promised -- but nothing here establishes the true value
• r-v5stage1r1designlayer 28699d8 — the task-author firewall has still never run. Whoever built this corpus has read all 241 records, so the record-blind half cannot be satisfied from here -- it needs an author whose only inputs are the base tree and the maintenance need, with the manifest proving it
• r-v5stage1r1designlayer 28699d8 — no oracle exists for any of the 62. Stage 0 recorded that reviewers thought one could be written; between that and a validated discriminating oracle sits the whole of G2, and nothing has crossed it
• r-v5stage1r1designlayer 28699d8 — the between-candidate variance in the power table is a range I chose to bracket, not a measurement. The pilot supplies the real value, and only then does the detectable effect stop being a family of curves
• r-v4qualification b8ff1b9 — G3 and G4 were judged from the commit message, the changed paths and the ruling. Neither reviewer read the current code or ran a test, so both are informed judgements about a maintenance task rather than measurements of one. G5 classifies whether an oracle could be written; none was built
• r-v4qualification b8ff1b9 — this says nothing about whether recording decisions helps an agent. It says the four surveyed repositories cannot supply gold that is independent of the records being tested, which is a fact about these repositories and this gate
• r-v3terminalseal 7754f1a — the placeholder row remains in the ledger and always will. This makes it legible, not absent, and a reader who takes digests on faith rather than reading the deviation is still misled
• r-v3terminalseal 7754f1a — the canonical digest binds the artifact list it is given. A transition that names too few artifacts is bound to a partial set, and nothing here decides what the right set is for a future study
• r-v3terminalseal 7754f1a — guard coverage is unchanged -- thirteen exclusion kinds remain uncovered and one scan inert, recorded in the mutation baseline
• r-readmeparity dc89a2e — parity is asserted here by four counts that happen to agree, not by a test. Nothing stops the next English edit from separating them again, which is the same hole this commit is closing and the reason the assertion is worth writing next
• r-fieldreportgenre 631150c — one run, one repository, one installer, and no method was recorded by whoever ran it. The section says so in its first sentence, but a reader who skims headings still meets a story next to a study, and no label fully removes that
• r-readmerunningcost 9abb092 — the token bullet states the budget cap, not what a payload actually costs in a given repository. The cap is what the code guarantees; the fill depends on record density and path scope, and nothing here measures that
• r-brandmarklifecycle 96a366e — CSS keyframes inside an -embedded SVG are renderer behaviour rather than a guarantee; a client that renders SVG without CSS gets the static logo, which is the intended fallback but is not the animated one. The reversal of The README asks a cold reader for four minutes before it earns one #450's limits-before-evidence order is a judgement made against a recorded decision, and should be reversed if the reason for The README asks a cold reader for four minutes before it earns one #450 still holds
• r-releasereviewstatus 37a0670 — this records the absence of a review, which is not the same as recording what a review would have found. It says the gate was the only thing that ran
• r-release120 b073960 — the passive notice only speaks once a check has landed, so the first invocation after this install says nothing however out of date the next release finds it. That is the trade the zero-latency design buys, and the answer arrives on the following command
• r-rel114 9692b6d — the README restructure and the mobile hero redesign are not in this release, so the four READMEs remain long and the hero's labels remain small at 375px
• r-oneblock 308be65 — the block moved out of the surface most readers see, so a benchmark number now costs one click to reach
• r-builderpin cb1515f — nothing checks that the pinned digest still exists upstream, so a digest deleted from the registry surfaces as a build failure rather than as a clear message
• r-onepointer a3d3b95 — a reader in the upgrade section now has no inline route to the generation table, only to the command that names the affected repositories
• r-ssotfive 9cff5ac — the translated sections were written to match the English contract rather than translated from it, so a later edit to one has no mechanical way of reaching the other three
• r-rel113 17a1301 — #749 question 1 stays open -- a fix that lives in the hook reaches a repository only on its next visit, and nothing on this machine knows which repositories exist
• r-koregdrift ca4f99b — nothing checks this -- the rule lives in the PR that established it and in a comment, and the next section written in the wrong register will land the same way these did, from a branch that never touched the file the rule was recorded on
• r-kohumanize 8e9cb09 — terminology is still doubled in places (path/경로, host/호스트, wiring/배선), and that is translation-consistency work that has to move ja and zh at the same time; one connective comma survives behind bold markers where splitting would make the span cross a sentence
• r-heromeaning 9c85ad4 — nothing checks that the hero and the payload block below it stay consistent -- the test asserts the inversion is absent, not that the two describe the same record
• r-protoown cac5cde — the evidence block is the other four-way duplicate and is untouched here -- check-readme-numbers.mjs still owns it in all four READMEs, and moving it is its own change with its own negative control
• r-heroalt22 19969c7 — the two contracts are still enforced in separate files, so nothing fails if one of them is deleted -- the note is what connects them, and a note is weaker than a check
• r-onevisual 5833281 — at 375px the README embeds at width="100%", so the 840px canvas scales by 0.446 and the 18px labels land near 8px -- better than the 1200px canvas it replaces (7.5px) and still under the 12px a caption usually needs; three columns and this copy do not fit under a 700px canvas, so the canvas question is unresolved rather than answered
• r-rel112 ad6fee3 — the readback confirms the link, not that the interpreter behind it runs -- doctor remains the check for that
• r-rel112 ad6fee3 — this repairs the installer; a machine already upgraded to 1.1.0 or 1.1.1 keeps its stale current until the installer is re-run, which is why the note names the command to check
• r-currentlink735 49ca9ff — unlink-and-rename is not atomic, so a reader resolving current in that window sees it missing -- chosen over silently keeping the old target
• r-currentlink735 49ca9ff — this fixes the report and the rename; a host that genuinely cannot symlink still falls through to the versioned-path note, unchanged
• r-readmewin111 b396de9 — the claim is Codex, Gemini CLI and Hermes on one machine at 1.1.1 -- claude-code is still notDetected there with its config present, and the READMEs do not promise otherwise
• r-clogherm111 1915356 — the release body for v1.1.1 was already corrected and republished; this brings the in-repository record to match
• r-rel111 8c29f5d — Hermes still fails on that machine for a cause that is not this one and is not yet named (Windows: every detected host fails to wire — the temp filename carries the whole path, and hasCommand cannot see a .cmd #716)
• r-rel111 8c29f5d — a zero-byte .cursor/mcp.json on the tester's machine is a user file; the installer read the file it says it reads and reported the true reason
• r-rel111why 8c29f5d — this changes the note, not the behaviour -- the behaviour shipped in the merged branch and is already covered by artifact:verify
• r-rel110 d9a041f — this release does not make host wiring work on Windows -- detection still cannot see a .cmd and spawn still cannot run one (Windows: every detected host fails to wire — the temp filename carries the whole path, and hasCommand cannot see a .cmd #716)
• r-rel110 d9a041f — 1.0.0 through 1.0.2 have no CHANGELOG entries; a pointer to the releases page stands in rather than reconstructing them
• r-rellock110 d9a041f — nineteen version surfaces was already wrong before this -- the lockfile makes it twenty-one, and the count is only ever known after the gate says so
• r-relmanifest110 d9a041f — this is the release commit's own repair, not a fix -- the next release will need the same regeneration for the same reason
• r-dead691 6680425 — install.ps1 line coverage is unchanged -- what ran before still runs
• r-rdupgr a3e04db — an upgrade path is documented where the install path is
• r-rel102 25c11ed — an installer-boundary fix reaches nobody until it is released
• r-adr22nm 31f6cf5 — a norm the product serves is not a capability the product claims
• r-v102doc 597dad7 — the file a reader trusts for a fact must hold the current fact
• r-693curr 14909c3 — a hook records a path that does not name a release
• r-693mut2 14909c3 — a rejection test names what does the rejecting
• r-rel101 b65e34f — a distribution-boundary fix reaches nobody until it is released
• r-660plug 5d0e422 — already installed is the upgrade case, never a skip
• r-680ver 47359a1 — an assertion that reads the source it checks proves nothing
• r-rel100 47359a1 — a published install URL must resolve the moment it is published
• r-590gate 63e48fa — the preregistered verdict is the authority for published M5 figures
• r-g1build 63e48fa — identity travels as version and digest, never as a path
• r-g1e2e1 63e48fa — parity is only measured across process boundaries
• r-gateplan 63e48fa — a plan that lives only in a session is lost at the next compaction
• r-readmecache653 359e0f1 — only the English README carries this sentence; the three translations do not, so nothing is left inconsistent by correcting it alone
• r-herosvg643 fc1009b — this renders in the README's first screen, so required wording must stay legible at mobile width
• r-readmefact643 fc1009b — section order, demo asset and exposure table are cross-file contracts over four language files
• r-canon605 f474cf4 — esbuild resolves a platform-specific binary
• r-rel0820 59c6730 — release versions must agree across manifests, lockfile roots, installer pins, and the runtime CLI
• r-epipe595 0d60c75 — the negative control could not be reproduced outside CI -- with the handler removed the suite still passes locally and in a linux container, because the probe reaches its five-second timeout instead of losing the race
• r-hostsay595 0d60c75 — this surfaces what the host command said; it does not diagnose a command that says nothing, and that case is now named as unknown rather than guessed at
• r-oid613 202913c — a source guard allows core/types.ts and rejects a local length copy anywhere else, so a future reader writing its own regex fails rather than silently reintroducing the class
• r-sha256oid 202913c — git object ids are hex, abbreviation 4, full SHA-1 40 or SHA-256 64
• r-522idx1 b0fa907 — a truncated scan must never render as a complete answer; unreadCommits is the existing channel
• r-522idx1 b0fa907 — --no-index and a filesystem that cannot write to .git still fall back to a scan
• r-answerown1 3547382 — warn distinguishes ours from not-ours by the command string, and does not execute anything -- a wrapper that really is a CommitLore server still reads as unverified, which is the safe direction but not a probe
• r-pretag01 86e0153 — registers_commitlore reads the key, so a config that registers under a different key -- a host with its own naming -- still reads as unregistered and is wired again
• r-engfloor01 fe83524 — the parser covers the range shapes npm packages actually publish -- comparators like >=22 <23, and pre-release identifiers, are read by their first version and not by their bounds
• r-dropfake01 06961d3 — the runtime's presence proves this installer wrote the directory, not that its contents are unmodified since
• r-secondcopy1 01ebee5 — the budget bounds the two scans, not the command -- process startup, path resolution and rendering still sit outside it
• r-staleclaim1 59cb5d9 — withholding uses the same pattern table as every other route, so a payload that trips nothing still passes; this closes a route that had no grading at all, not the heuristic behind it
• r-nodefloor1 f4c924f — this bounds the version, not the feature -- a Node that ships node:sqlite behind a flag, or removes it, is not detected here
• r-release081 ffe702a — the capture half reaches a host that surfaces MCP instructions; one that ignores that field still needs --agents-md, and nothing detects which kind a host is
• r-observed01 43cfa5e — existence is not identity -- a path that resolves to something other than this tool still reads as a working registration, which is doctor reports a registered MCP command as working without establishing its identity #572
• r-ownsemver1 fcc6e4a — the evidence is a directory this installer wrote, so an install whose data directory was deleted is now refused rather than upgraded -- a refusal naming the file, against silently destroying it
• r-saywhat01 56444db — entailment is still unchecked, and this narrows the claim rather than closing the gap -- the protection remains that no drafted record is ever delivered as a directive
• r-bynottname1 8beaa6d — an entry whose command is launchable but wrong still counts as a registration; the check establishes that a host could start something, not that what it starts is this tool
• r-winstall1 0b4e551 — this pins what the repository says about itself, and cannot check that the tag it names has been published -- the install gate does that, after the tag exists
• r-vbind001 2c88d24 — this binds the requested tag to the runtime that answers, not the tag to its content -- a tag moved after publication installs whatever it now points at, which is a signing question rather than a version-binding one
• r-insttxn1 afb7bfb — this establishes that the installed tree is complete and its commands run on this machine at this moment -- not that the machine will still have a working node tomorrow, and not that any agent host will load what was installed
• r-authdir01 ae2a66f — in the default mode a directive establishes that the commit's author string matched a configured one, and nothing about who produced the commit
• r-authdir01 ae2a66f — in signature mode a verified signature establishes that a key the verifier trusts signed this commit -- not that its holder has authority over this repository, and not that the record's content is true or safe
• r-codexreg1 5933aa4 — an entry can be correct when the installer reads it and wrong afterwards -- a later install, a moved data root or a hand edit all leave the name intact, and nothing revisits it until the installer runs again
• r-codexplug e5fe95a — a plugin can put a skill in front of a session; it cannot make the session follow it, and nothing here reports whether one did
• r-readme001 7f82d47 — the README still cannot tell a reader whether their particular host will follow a written procedure; only the hosts with a plugin or an installer have that answered by a mechanism rather than by hope
• r-hermesx01 2eb8176 — hermes skills inspect resolves remote sources only in this Hermes version, so discovery was verified through hermes skills list --source all in a fresh isolated profile rather than from inside a live conversation; that a session then follows the procedure is not something an installer can establish
• r-codexwire 955f290 — an instruction file is guidance, not enforcement -- a host may ignore it, summarise it away, or never read it, and nothing here can tell whether any session followed the procedure
• r-cdeb10reg 48bd5a8 — wrong-path viability, deterministic oracle feasibility, code disclosure, bounded implementation, and unproven ordinary or benchmark authorship cannot be decided from history and remain undecided for human review
• r-cdeb08an 60db89f — the paired bootstrap describes resampling stability within these five frozen repositories and thirty frozen tasks, and says nothing about any other repository, task or agent population
• r-unattshadow b7b532a — together the two features measure how often an unattended pipeline would have written, and remove the asking from the writing -- neither half can say whether what gets written is worth a reader's attention, so shadow's number for an unattended repository is a volume, not a value
• r-retireserena c1171ef — the preregistration fixes claims before numbers exist, so what it says about the calibration cannot move to match later tree state
• r-readmeorder 383f77d — the hook leads with the headline number, so a reader who stops there has the effect without the conditions on it; the section naming those conditions is now two screens up rather than at the end, which is a shorter path than before but still a path
• r-m5sources b910dba — the seven shards are declared individually, so a shard added later is invisible to this block until someone lists it -- which is the property the declaration was built for and the cost that comes with it
• r-rel071 af8e0ab — 0.7.0 stays published with its notes amended to name the defect at the top; retracting a tag people may already have installed trades a known-bad version for an unknown one
• r-rel070 d4a4d8b — the README's behaviour claim now rests on M5 while the generated numbers block beneath it still publishes M4, which is The README's generated numbers block still publishes M4; M5 measured the thing the README leads with #480 rather than a release-time edit
• r-numgate b770054 — the README's behaviour claim and the generated block below it now describe different studies until The README's generated numbers block still publishes M4; M5 measured the thing the README leads with #480 lands
• r-readmem5 6d04c0b — the README now leads its behaviour claim with a [claim]-tier number while shipping a [directive] tier nobody has measured, and that gap will widen until something measures it
• r-clog070 172fa3d — the entry stays under ## Unreleased and names no version, because the version bump belongs to the release commit and a changelog that pre-announces a number can be wrong about it
• r-readmecold 08efdff — only README.md is reordered, so the ko, ja and zh-CN readers still meet the evidence first until the follow-up lands
• r-selfaudit cd0068f — the page is maintained by hand, so an entry can go stale against the code it describes; the closing line says so and asks for an issue when it does
• r-cdebver01 ce7b278 — the schemas freeze protocol 1.2.0 constants -- thresholds, matrix size, category names -- so a protocol change is a schema change and CI notices
• r-claimsmatch 506ada4 — this fixes the sentences an external reviewer found; no systematic pass was made over every claim in the four files against every published measurement
• r-m5analysis 3450656 — the script enforces the row count, not the identity of the rows; a run that produced 1,160 rows under a changed harness would satisfy it, which is what harness_commit and dist_digest on each row are for
• r-benchscope 67f4375 — nothing checks the shape of the eight metric-row files. This gate names them and steps over them, and bench/deterministic/types.ts is the only definition that family has -- there is no JSON schema for it, so drift on that side is still invisible
• r-benchscope 67f4375 — the pre-provenance exemption reads started_at, which is data on the row rather than a fact about the file. A row that misreported it would be held to the shorter list of requirements; that is a deliberate falsification rather than the omission this fixes, and nothing here detects it
• r-priorart 507ae24 — the comparison is against Lore's README and its abstract; the full paper was not read, so a lifecycle described only in the PDF would have been missed
• r-scaleproof 4c093f2 — the 100,000-commit figures come from a synthetic repository built by the deterministic harness, not from a real codebase of that size, so they describe the index's shape rather than any particular project
• r-extbaseline 064daf6 — the band is four Python repositories chosen for having enough revert history to backfill from, so it is evidence about large long-lived Python projects rather than about repositories in general
• r-3c9d52 dc9e769 — the sweep is two git log calls per path and the delivery phase runs git log --follow on every tracked path, so a full run over the four externals is hours rather than minutes on one machine
• r-ledgerresult bc31c90 — both sides are byte-derived proxies under CHARS_PER_TOKEN=4 rather than a provider tokenizer, so the ratio cancels a uniform error and not a differential one between diff text and prose
• r-ledgerresult bc31c90 — break-even in reads assumes reads land on the evaluation set the way the delivery run's per-path average describes, and real editing concentrates on a few files
• r-surfacedeliv fae9e1e — every figure in the table is measured on this repository measuring itself, which is the weakest part of the evidence and is stated in the paragraph rather than left for a reader to discover
• r-rel060 e999b9d — the install one-liner in all four READMEs now points at a tag that does not exist until this is tagged, so the window between merging to main and pushing v0.6.0 is one where the documented install is broken
• r-pipesplit b4fa571 — test/dogfood.test.ts validates every record in this history, so a new violation class is only available if it rejects none of the 620 Ruled-out: values already written
• r-readmesplit344 7314a03 — three checks bind content to a position in the README, so the complete record example, the protocol vocabulary table and the generated benchmark block could not move
• r-failopen abc54ea — with the gate installed and no CLI resolvable, commits are still refused -- that is the one hook holding a verdict back, and this change does not reach it
• r-heropolish f6144bc — README.ko.md still switches from 존댓말 to 해라체 below the hero; that split is older than this change and belongs to the restructure in README still carries the reference manual it should be linking to #344
• r-pluginpath353 e364f3a — a plugin manifest has no way to add anything to PATH, so no plugin-side change can make the documented commands resolve
• r-realoutput f9efea0 — a README block introduced as what the tool prints is a behavioural claim, and inventing its shape is the same defect as inventing a number
• r-release051 19810d2 — the hook is written at install time, so no release repairs a repository that already has one; every release touching hook behaviour has to restate what does
• r-heroinherit 89b13ac — a headline that implies detection commits the product to guard's numbers, and guard is an advisory measured at 22% recall
• r-convertreadme e12c816 — a README claim about the default workflow is only true if the shipped skill performs it, and the skill currently requires the user to name CommitLore first
• r-fieldreport 753f4e7 — this section reports one engineer's day on one repository; it is evidence that the mechanism works there, not a measured effect size, and the wording has to keep those apart
• r-readmefinal 40aeae0 — a mutation oracle anchored on a claim that can become false will silently stop testing when the claim is removed; the needle has to be asserted present
• r-release050 ad402c7 — the hook is written at install time, so a corrected release never reaches a repository that already has one; every release fixing hook behaviour has to say what repairs an existing install
• r-compat1122 e7d8516 — a non-empty guard does not detect deletion; each table's row keys have to be asserted as a set or the statement can silently shrink to one row
• r-compat1122 e7d8516 — substring comparison hides a narrowing -- ./ is inside ../ and Edit|Write is inside Edit|Write|MultiEdit|NotebookEdit -- so cells are compared as their rendered form
• r-compat1122 e7d8516 — a sentinel containing \0 makes git treat the file as binary, which costs it diff, blame and log -p permanently
• r-compat1122 e7d8516 — the plugin path needs bash, because scripts/commitlore-run.sh carries a #!/bin/bash shebang, and no install script checks for it
• r-muslbullet1126 04ac181 — this ticket owns four bullets and not the tests that read the section around them, so a check that breaks here means a region was taken that was not allocated
• r-ps1stderr282 e37b4d3 — Windows PowerShell 5.1 turns a native command's stderr into a terminating error under $ErrorActionPreference = Stop, so no native call in this script may merge stderr into its output
• r-t1120nodeinst 14deeb4 — git and node are hard prerequisites now, so a host without them installs nothing and says which one is missing
• r-gateb3rev a2e38b9 — the shipped install.sh downloads a platform asset, so no document may describe it as Node-only until the installer itself changes
• r-rel041notes 71efe1f — 0.4.1 makes the installer honest about a verification it cannot complete rather than fixing the kill, so an upgrading user may still see the unverified message instead of a version
• r-instverify256 3715677 — the root cause of the signal kill is unestablished; this makes the installer honest about it rather than fixing it, and Documented install exits 137 on upgrade: a killed verification turns a successful install into a failure #256 stays open for the cause
• r-rel040pins b76c40b — the pin names a tag that does not exist until the tag is pushed; between this merge and that push the documented command refers forward
• r-rel040notes 5d57a72 — the 26.3-point density gap quoted in the notes is measured at this head and will drift with merge volume; it is illustrative of the denominator problem rather than a stable figure
• r-t1016svg 321c6f1 — byte-exactness is verified on this platform; a different platform's Node could in principle render differently, and nothing here proves it does not
• r-t1021known 8dfffc1 — the figures are measured against one archived 417-decision corpus, which is deliberately hard and is not deployment prevalence
• r-pin030readme 504b54e — install.sh must already support tag-based download for the one-liner to work; verified that the URL resolves to a tagged tree
• r-notes030 a289ca5 — the density denominator is named here and in the handoff, not in the harness that emits it, so the next run reproduces the same ambiguity
• r-hero172a bc0d971 — Stale-exposure benchmark is one corpus, one query, and one pinned embedding model at a fixed two-record budget
• r-be140cost 8c01bd5 — no per-turn provider token ledger or observed avoided-work cost exists yet
• r-readme129 ab5f210 — the break-even rests on tokens estimated from bytes at the product's own four-characters-per-token constant, so it moves with that assumption
• r-m4basis 5e2d2cb — the guard question stays unanswered until the exposure instrument is verified and M4 is rerun on it
• r-m4withdraw e5f9b73 — the guard question is now unanswered rather than answered null
• r-instpath119 9e1fce7 — a user who ignores the printed line still gets "not found" on the next command
• r-readmeux1 b664205 — interactive record building does not exist, so the honest answer is still "an agent writes it or you do"
• r-rel021a a79e350 — v0.2.0 remains on the remote with no release attached
• r-readmepos1 3cbcaaa — BENCH block is generated by bench/report.ts and must remain byte-identical
• r-expreadme1 9e69abe — bench/VERDICT-M4.md still cites the Fisher figure; the two disagree until the verdict records why the number was withdrawn from the README
• r-expomerge1 d6ad014 — M4's existing rows have no exposure field and must read as unknown, not as not-exposed — backfilling by inference would erase the finding
• r-f61a2c 9114cf0 — the matcher remains deterministic and lexical; no embedding or semantic service is available to distinguish paraphrases
• r-rdme96a 9c9371c — scripts/check-readme-numbers.mjs's withdrawal-notice and stray-statistic checks constrain what can appear outside the (absent, here) generated benchmark block — re-checked after every edit, not just at the end
• r-fix92dupid 7f41a6e — cross-references between two blocks declared by the same commit (a Follows:/Supersedes: naming a sibling block's id) are still reported as dangling rather than resolved against the sibling -- unchanged from before this fix, and called out in validate.ts's own comment as future work
• r-fix93pkg 9c4a396 — package.json remains a development artifact (build, typecheck, dependency floor) -- it is not read as a distribution manifest by anything in this repository
• r-relinstall c6e1d04 — never tested against the real GitHub release infrastructure (no release exists yet — that is the owner's action) — verified against a locally built SEA binary, a hand-made SHA256SUMS, and a local HTTP server standing in for GitHub's release-asset redirects, which is everything this repository lets a change verify before a tag exists.
• r-distrace88 d118a73 — the fix insulates bench-ablation.test.ts from the race; it does not remove the underlying design (four test files independently, redundantly rebuilding one shared dist/ in their own beforeAll). A fifth file doing the same thing, or a future check elsewhere that also depends on dist/'s mid-run stability, can still race the same way.
• r-parsemulti 6d39d25 — parse has no git-commit context (no sha, no notes mirror) — its identityCollision check is local to the one message being parsed and cannot detect a Record-Id that collides with something already committed elsewhere in history the way context's fold does.
• r-multirec01 92aeb24 — parseRecordBlocks only recognizes a non-final block by its declared Record-Id, so an unidentified inherited record beyond the first stays recoverable in the plan that computed it but not in a later re-parse of stored text; squash-preserve orders unidentified blocks last so the common case (at most one) is unaffected.
• r-multirec01 92aeb24 — multi-block reference checking (Follows:/Supersedes:) does not resolve one block's reference against a sibling block declared by the same commit; each block is still checked against every earlier commit in history.
• r-exit065 e545dee — any new command's exit codes must be drawn from SPEC §10, not invented locally
• r-adr0012 e263059 — node:sqlite is experimental and version-gated -- it does not exist before Node 22.5, which satisfies but predates the >=22 floor in package.json; loadDatabaseCtor stays lazy so that gap degrades to --no-index instead of breaking validate/guard/parse
• r-fix70a1 d707fc7 — one encoding layer and explicit lexical forms in the four published languages; semantic paraphrases, nested encodings, and split payloads remain outside coverage
• r-shallow66 60a8659 — a depth-1 clone can only inspect its reachable commit history
• r-det058 695cdf6 — the suite must need no model, agent, network or uncommitted benchmark input
• r-7a3e91 cf859e4 — better-sqlite3 stays external because it is native — the bundle degrades to --no-index without it, which only works because r-6f2a08 made that load lazy first
• r-9c07e2 9c4d25a — the plugin still needs Node for the CLI — the protocol does not, but guard, the index and the MCP server do (T-706 · Bundle the CLI as a single file — run from a clone alone #38)
• r-9c2f74 d653153 — the ablation arms cannot discriminate on these fixtures -- no-grade and no-lifecycle are byte-identical to the treatment in 9 of 10 tasks, because the seeds carry one reconstructed record and one task with a lifecycle trailer between them
• r-9c2f74 d653153 — the harness assembles its own projection rather than calling the shipped injector, so what is measured is the harness's rendering of the records, not src/core/inject.ts (issue B-08 · Replace the benchmark harness injector with the actual src/core/inject.ts #36)
• r-4a8e15 49e12c7 — git's grammar requires a subject before a trailer block, so a serialized block is not by itself a parseable message
• r-6e1a72 5e09846 — npx commitlore is the first thing a reader will try, and it fails until the package is published
• r-7e5f02 e5f5e00 — npm installs through an engine mismatch, so the ecosystem's own signal cannot be relied on to stop anything
• r-7f0e39 76f3f2d — literal substitution only catches the exact strings you list, so the same term written with a different separator survives
• r-5a8c04 c46a577 — git owns the definition of a trailer block, so any behavior we cannot get from interpret-trailers is behavior we must not invent
• r-9d31b7 4ac6e30 — the example lives in four translated files, so any fix that is not mechanically enforced will drift again on the next edit
• r-c0f4e2 3d249cd — npm gitlore is held by an active same-domain CLI, so the owner's first-choice name was not available
• r-b2e7f1 00d348d — Parsing must delegate to git interpret-trailers -- reimplementing the block rules would drift from the rest of the git ecosystem
• r-a8f3c1 ef48843 — Rename must land before any code exists -- after 27 tickets it would touch spec, fixtures, index, hooks and every doc

Ruled out (409)

• r-typesnodefloor b59adb6 — taking the 22 -> 26 major bump of @types/node (chore(deps-dev): bump @types/node from 22.20.1 to 26.6.3 #1151) | types from a later major describe APIs node 22 does not have, and the type checker is the only thing that would refuse them, so a release would compile here and fail on a supported runtime
• r-ef0defcd69a8 11ef133 — publishing this release as 1.6.1 rather than 1.7.0 | COMMITLORE_DOCTOR_REMOTE_TIMEOUT_MS is a new setting and hooks install has a new way to exit 2, and 1.6.0 set the rule that a new configuration key makes a minor
• r-276fed4dac2b d71a55c — publishing this release as a patch rather than a minor | commitlore.syncRemote is a new configuration key and a dry run's --json outcomes changed names
• r-release151 94e85f9 — keeping the regenerated manifest in the release commit | canonical-merge refuses that path outright, and the canonical build is what writes it
• r-release151 94e85f9 — publishing this version bump as a minor release rather than a patch | the only user-facing change is the folded-block withholding defect, and a defect fix that adds no command, flag or trailer key is a patch
• r-release151 94e85f9 — bumping the CHANGELOG's 1.5.0 heading or the ADR's gitlore@1.5.0 | the first is the previous release's own heading and the second is another package
• r-release151 94e85f9 — text-replacing the version in the lockfile | it also matches dependencies genuinely at that version, and no test reads those fields, so the corruption is silent
• r-mcpdualrole1056 4b7a8aa — keep .mcp.json and find a launch form that works for both loaders | the loaders differ in whether they define ${CLAUDE_PLUGIN_ROOT} at all, so no single value of that path is right for both; three releases tried three forms and each moved the failure rather than removing it
• r-mcpdualrole1056 4b7a8aa — declare mcpServers inline in each plugin manifest | the two manifests would then carry two copies of one launch command that must stay byte-identical, and the existing Codex manifest already proves a path resolves from the plugin root
• r-mcpdualrole1056 4b7a8aa — substitute an absolute path at install time | unchanged from r-pluginrootdefault870 -- the file is committed and shipped, so a machine path breaks every other clone
• r-mcpscopes1 d2741f3 — writing the host's user and local configuration directly | the format is the host's, it is already on its second shape, and a writer that guesses it wrong produces a file the host silently ignores -- the CLI is the one component contractually able to write it
• r-mcpscopes1 d2741f3 — routing project through claude mcp add --scope project too | that would drop three behaviours this writer has and the host's does not promise: merging without touching other servers, refusing to overwrite an entry an operator chose, and working on a host that ships no CLI
• r-mcpscopes1 d2741f3 — telling "already exists" from a real refusal by matching the host's message | a message is a rendering and changes without notice; the exit code of a separate mcp get answers the same question and is the host's own contract
• r-mcpscopes1 d2741f3 — defaulting runInit to the same scope as the CLI | two of the four scopes write outside the repository the caller handed in, so the programmatic default is none; otherwise this suite alone would have registered a server on every machine that ran it
• r-mcpscopes1 d2741f3 — falling back to the default when --mcp-scope is misspelled | the flag exists so the operator chooses, and silently installing something else while saying nothing is worse than the usage error
• r-treebind1030 ad4c4ef — resolving the repository from the caller's argument | r-emptystageddiff911 refused it and the refusal stands -- a caller that names the tree would turn a wrong-tree answer into a wrong-tree write, where an assertion can only produce a refusal
• r-treebind1030 ad4c4ef — inferring the caller's working directory from the process tree | MCP carries no such field and the inference is wrong in exactly the multi-worktree case this exists for, which would make the check fail where it is needed
• r-treebind1030 ad4c4ef — refusing every prepare whose staged diff is empty | it is the report's preferred shape and r-emptystageddiff911 already measured it out: it removes recording a decision with no code change and contradicts harvest --prompt-only emits nothing without a staged diff, though the contract it prints is static #310
• r-treebind1030 ad4c4ef — naming the repository in the harvest prompt's no-diff branch | text present only in that branch inflates the pricing scaffold above a real prompt, which test/token-ledger.test.ts refuses -- the same rejection r-emptystageddiff911 recorded
• r-treebind1030 ad4c4ef — git rev-parse --path-format=absolute for the common dir | it is git 2.31 and later, and this package states no git floor beyond "and Git", so it would turn a correct assertion into a refusal on the oldest runtime
• r-readmeaccuracy140 ba745bf — aligning the README's study figures with docs/evidence.md | the sentence names the registered study, and bench/VERDICT-M5.md is that study; matching the other document would have made the page disagree with the verdict it cites
• r-readmeaccuracy140 ba745bf — releasing this on its own | nothing here changes behaviour, and a release exists to ship a build rather than to correct a page
• r-readmeaccuracy140 ba745bf — keeping symbol anchors in the bullet so the oracle needle survives | that is a page describing the product to suit a test, which is the direction this is correcting
• r-measurewrites988 4edfd9f — PRAGMA page_count deltas for write amplification | it measures growth, and freelist reuse is invisible to it -- which is how the zero was produced
• r-measurewrites988 4edfd9f — whole-database bytes divided by a row count | it prices a proposed table with the average of every existing structure
• r-buildbeforetest960 346006a — a vitest globalSetup that builds | it would build for every invocation including a single-file run during a debugging loop, where the developer is already rebuilding deliberately
• r-buildbeforetest960 346006a — a test asserting dist matches src | a local esbuild bundle is not byte-identical to the canonical Docker build that is committed, so the comparison is red in a clean checkout
• r-believablesuite960 3ee700c — making the mutation check a CI gate | a gate would be answered by tests that fail for any mutation, which is not the same as tests that check the property
• r-believablesuite960 3ee700c — splitting the suite into a fast tier and a history tier | the split runs along a line nobody can maintain -- most files build a temporary repository and a handful read the real one, and the boundary moves every time a test is added; bounding the parallelism needs no boundary
• r-believablesuite960 3ee700c — lowering the global testTimeout and giving every slow test its own | it moves the same contention limit rather than removing it, which the vitest 4 upgrade already measured
• r-pinnedmirror957 a06b984 — a rev-parse after the pass to detect that the ref moved | it is detection rather than closure, costs a process, and still leaves the caller holding rows it has to throw away
• r-pinnedmirror957 a06b984 — accepting the window because it self-corrects | it corrects on the next call only while the ref keeps moving; a ref that returns to the stamped value leaves the mixture in place indefinitely
• r-pinnedmirror957 a06b984 — cat-file --batch-command to fetch bodies and commit fields together | its format atoms carry no committer date and no %G?, and an embedded signature is not git's verification verdict
• r-pinnedmirror957 a06b984 — re-scoping a resumed queue against the current mirror | the rows already written came from the earlier scope, so re-scoping would mix two of them under one stamp -- the defect this closes, arriving by another route
• r-probeconsumers975 adcbd50 — batching inside collectRange | it is squash-preserve's reader and doctor's, not validate's, and batching there changed neither command -- the stack attribution is what found the reader that mattered
• r-probeconsumers975 adcbd50 — memoising the note blocks by sha alone | the reference pass sees sources with no sha yet, which is the case the commit-msg hook takes, so the cache is keyed on the message text
• r-probeconsumers975 adcbd50 — pairing noteMessages with readRecordBlocks | both call showNote, so the batch would have read every note twice and spent more processes than it saved
• r-probeconsumers975 adcbd50 — writing the measurement rule down without a harness | I had noticed this failure three times before making it a fourth, so noticing is demonstrably not the mechanism
• r-monotonic968 8f5ee12 — holding the writer lock across the scan | it closes the unbudgeted case too, and serialises cold rebuilds on exactly the path the budget exists to keep bounded
• r-monotonic968 8f5ee12 — recording an indexed-commit count to compare against | scan_pending already carries it, and a second number for the same fact is a second thing that can disagree with the rows
• r-monotonic968 8f5ee12 — comparing without pinning HEAD | two rebuilds against different heads owe different things, so the comparison would refuse a rebuild that is not worse, only different
• r-monotonic968 8f5ee12 — accepting the regression because it is recoverable | it is recoverable over later calls, and the answers given in between come from an index that was complete a moment earlier
• r-probebatch951 8d78b62 — appending the marker to the paragraph | git accepts a group holding a recognised trailer once a quarter of its lines are trailers, so one appended line can carry a paragraph over the threshold and manufacture a block; and a scissors line swallows an appended marker while still emitting the trailers above it, which moves those records into the next paragraph's answer
• r-probebatch951 8d78b62 — counting markers against the answers written | that detects a duplicate index and not a missing one, so the scissors case passed it -- the count has to be against the inputs, in order, or it is checking its own output
• r-probebatch951 8d78b62 — a trailer atom for a note's body | %N is the note text and %(trailers) parses the annotated commit's message; adding both to one format does not compose them, so a note's own block stays a process
• r-probebatch951 8d78b62 — deciding a paragraph's shape without git | SPEC 2.1 B3 is unreproducible by line matching, and the 25% rule found here is a second reason the rule is not the one a regex would encode
• r-atomreuse951 eb2869d — tightening the candidate prefilter in the same change | the necessary condition a tighter filter would test is "a line beginning with the exact key", and trailer.<token>.key lets a repository configure an alias git would emit that key from, so a pure regex cannot be a sound filter without first reading that configuration
• r-atomreuse951 eb2869d — batching the candidate parses into one process here | git processes several files in one invocation but emits nothing between them, so attribution needs a sentinel trailer appended to each paragraph; that is a real design with a real proof obligation and does not belong in a change whose whole claim is that it altered no row
• r-atomreuse951 eb2869d — passing the stripped trailers as the last block | stripConventional can empty a block that git parsed as non-empty, which changes blocks.length <= 1 and so which messages are treated as multi-block; the raw atom field is what the existing entry point takes
• r-resume951b 3c1412d — relying on the sha-qualified retirement for notes as well | a note's identity is the commit it annotates, and that object is unchanged when the note's content is not, so the same sha names different work under two mirrors
• r-resume951b 3c1412d — keeping the indexed notes prefix when its mirror is gone | with both the live ref and the stamp unset there is no later call that would re-read it, so the prefix is permanent and nothing reports it
• r-resume951b 3c1412d — leaving the unborn-HEAD branch alone as out of scope | it is the one path that returns before the queue is looked at, so a backlog parked there is the one backlog nothing can drain
• r-resume951 83f5629 — a positional watermark into rev-list <head> | grafts, git replace and a deepened shallow clone all change that list without changing the commit it starts from, so the saved offset silently addresses different work
• r-resume951 83f5629 — deriving the unread set from rows already stored | a commit with no trailers leaves no row, so a processed recordless commit and an unread one are indistinguishable in trailers and commit_paths
• r-resume951 83f5629 — making the budgeted incremental resumable with its own watermark | its range overlaps scan_pending, and two watermarks over overlapping ranges can disagree about which commits are owed
• r-resume951 83f5629 — leaving the drain the whole remaining budget | it converged in four calls and made every budgeted call cost the full ceiling, which is the edit hook's latency on every fire until the backlog cleared
• r-changelogprose 84dcf58 — holding it for 1.2.20 | the defect excuses a lost record, and the release it would wait for has no date
• r-release1219 6fd1ed5 — holding the mode-only fix for its own release | it is a wrong verdict that prescribes writing records onto a commit, and it has shipped in every version measured
• r-release1219 6fd1ed5 — a minor version | nothing gained a command or changed a contract; one verdict got narrower and three paths stopped repeating themselves
• r-release1218 3ba5d09 — folding this into 1.2.17 | that release is tagged and published, and the guard's whole claim is that it would have failed on it
• r-release1218 3ba5d09 — a minor version | nothing gained a command or changed a contract; a test artifact moved and a test was added
• r-release1218 3ba5d09 — shipping the baseline in spec | package.json ships that directory, and 80 KB of one implementation's regression record is not the protocol
• r-changelogmood e619a0d — a new version number for the correction | 1.2.17 was never tagged, so no installed copy carries the first form and a number spent on it would describe nothing
• r-release1217 4836a95 — holding the two fixes for separate releases | they are one report from two directions, the second was found while fixing the first, and their fixtures share a directory and a test
• r-release1217 4836a95 — a minor version for the new capture refusal | it refuses a draft that would have been withheld anyway, so no record that reaches a reader today stops reaching one
• r-release1217 4836a95 — text-replacing the version in the JSON files | the lockfile holds dependency versions that resemble ours
• r-release1216 573d14c — calling this a minor release | nothing gained a command or changed a contract; vantage is a field added to an envelope, and the rest are fixes to what existing surfaces report
• r-release1216 573d14c — holding the parser change for its own release | it shares a file and a test harness with the notes fix, and separating them would leave a commit whose source and tests disagree
• r-release1216 573d14c — text-replacing the version in the JSON files | package-lock.json holds dependency versions that resemble ours closely enough for a careless pattern to reach one
• r-release1215 b6d2cfe — text-replacing the version in the JSON files too | package-lock.json holds dependency versions that resemble ours, and one of them is close enough that a careless pattern reaches it
• r-release1215 b6d2cfe — releasing as 1.3.0 rather than a patch version | every change here is a fix to how a diagnostic reports, and no command's contract or output schema moved
• r-release1215 b6d2cfe — holding README's squash-inheritance workflow omits the required cli-path input, so the recipe as published cannot run #926 for its own release | the broken recipe is published and reachable now, and the row that hid it shipped in the same version
• r-recipecannotrun926 6445ac3 — make cli-path optional in the action | the comment beside required: true is correct and the reporter said so: the package is private, the public name is unclaimed, and an npx fallback would run whoever takes it
• r-recipecannotrun926 6445ac3 — fix the README and leave the row reading the reference | the row is what made a broken recipe look installed, and the next wrong recipe would be just as invisible

Truncated: 454 lines omitted — the comment hit GitHub's 65000 character limit.

_{Trailer violations fail this check. Active constraints are informational — they are what the repository already decided, not a verdict on this PR.}