Release 1.1.4

[MongLong0214]

One line changed for anyone using the tool. The rest is the repository telling the truth about itself, which is most of what this release is.

The user-visible change

The pre-push hook printed notes mirror (origin) failed: spawnSync git ETIMEDOUT. Nothing was wrong with the transport and the rest of the line already said what to do — but naming the call that returned rather than the decision that was made reads as git having failed, and sends whoever gets it to look at a remote that is fine.

before   failed: spawnSync git ETIMEDOUT.
after    failed: the 2s this hook waits for the remote ran out.

The value is interpolated from the constant, so the sentence cannot drift from what it describes. A refused connection still reports as a refused connection.

What a contributor gets

A source-only change can land without producing the canonical linux/amd64 artifact. The canonical workflow merges the source, rebuilds, and opens a pull request carrying the result, so all twelve required contexts run on the tree that lands. Observed end to end (#761 → #762 → e4e5154), with a tampered bundle refused by the same path (#763).

The job holding the App credential now checks what the rebuild handed it rather than publishing it: recomputes the merge from main and the pull request ref, pins both parents, allows a difference only inside dist/ and the manifest, refuses a pull request that moved while the rebuild ran, reads the pushed branch back by sha, and mints a token scoped to this repository with two permissions.

The canonical builder is pinned by digest — a mutable tag made "deterministic" a claim about one morning.

Documents that were wrong

readiness SSOT	named a release two versions old, said no feature work was planned on a day it shipped, listed a fixed defect as current
upgrade contract	said hooks from v1.0.2 follow upgrades; true of the path, false of the stub — v1.0.2–v1.1.2 follows current and still refuses the commit
three translated READMEs	said nothing about upgrading at all
benchmark block	lived in four files, compared in one

Verified

34 install-shape pins moved; the four remaining v1.1.3 mentions are
   generation-boundary prose that bumping would falsify
lockfile's two version fields set by parsing JSON, not text replacement
artifact:verify passes against the regenerated manifest, dist unchanged —
   the bundle reads its version at runtime
135 tests across manifest, readme, compatibility, artifact and
   release-prerequisite suites

Merge with a merge commit. Squash and rebase are disabled on this repository, so the button offers only the right one.

Limit (on the commit): the README restructure and the mobile hero redesign are not in this release.

[github-actions]

CommitLore — record lint

Trailers: clean — 3 commits in origin/main..2f85407e6c08fe600fee689445647184c6a286db
Active constraints: not read — commitlore: git log --follow accepts exactly one pathspec, so renames are not followed for 12 paths; query one path at a time to follow its rename chain (12 changed paths)

_{Trailer violations fail this check. Active constraints are informational — they are what the repository already decided, not a verdict on this PR.}