Release 1.2.0

[MongLong0214]

Cross-provider review unavailable. grok is at HTTP 402 and codex is over its usage limit as of 2026-08-19; the Hermes gateway is out of credentials for the same reason. This carries gate-green only. Claude reviewing Claude is not cross-provider — the same model family shares blind spots — so nothing here has had a second provider's eyes.

Blocked only on CI. Merge when green, then tag v1.2.0 on the merge commit.

Release 1.2.0. Thirty-one commits since 1.1.4.

What a user gets

commitlore upgrade — there was no way to find out a newer CommitLore existed. --version reported what was running and compared it to nothing, so a repository initialised on a stale install kept validating commits with a stale protocol and nothing said so. This is the release that makes later releases discoverable, which is why holding it costs more than shipping it.

Both installers register the same hook, and only one of them. A CLI install delivered nothing when the agent edited with MultiEdit; a plugin install delivered nothing when it read a file before deciding. And following the README to the plugin and then running init answered every matched tool call twice.

A hook fire costs a third less; a rebuild an order of magnitude.

	before	after
hook fire, path with records	528 ms	399 ms
rebuild, 1122 commits	45 s	2.3 s
rebuild, 10000 commits	>120 s	2.2 s
first answer, cold 10k index	partial	complete, 2.9 s

Fixed: a partial index answered with silence, which reads as "no records here" (#778); a rebuild could not get past a schema change (#779) and could not open a damaged index at all (#785).

Issues closed since 1.1.4

#742 · #775 · #776 · #778 · #779 · #781 · #782 · #785

The bump itself

Four manifests, twenty-eight pins across four READMEs and both installers, the CHANGELOG entry, and the artifact manifest.

Three things this release procedure gets wrong if done quickly, all avoided here and all recorded:

• package-lock.json carries the version twice and a text substitution for "1.1.4" also matches four dependencies genuinely at that version. Both fields were set by parsing the JSON.
• The pins are anchored to the three install shapes, not to the bare version string. README.md carries prose about release boundaries — "One installed before v1.0.2" — which is a historical fact that a blanket bump turns into a false statement, and no test reads it.
• dist/ needs no rebuild but the artifact manifest does. The bundle reads its version at runtime, so the bytes are identical; the manifest binds the source inputs, so the bump alone moves its digest. git status shows installer/canonical-artifact.json and nothing under dist/, which is the check that this was done right.

[github-actions]

CommitLore — record lint

Trailers: clean — 2 commits in origin/main..37a0670717f1ca2e7fcbc43498c361f41aede05d
Active constraints: 228 limits · 321 ruled-out · 59 warnings — from 282 records over 12 changed paths

Active constraints for the paths this PR touches

Limits (228)

• r-releasereviewstatus 37a0670 — this records the absence of a review, which is not the same as recording what a review would have found. It says the gate was the only thing that ran
• r-release120 b073960 — the passive notice only speaks once a check has landed, so the first invocation after this install says nothing however out of date the next release finds it. That is the trade the zero-latency design buys, and the answer arrives on the following command
• r-lazysignaturemode f7dc7ef — a scan that reads even one commit still asks, so the cost returns on any invocation that has catching up to do. That is the invocation that can afford it
• r-rebuildworknobodyreads 1a66b26 — the deadline is still only checked between batches and before the expensive half of one, so a late batch of 1024 commits can overshoot by whatever that batch costs -- bounded by one batch rather than by the whole scan. And an unsigned-mode index now carries '' where it carried git's verdict, so a reader wanting the cached status without turning signature mode on no longer gets it; none exists
• - 1ca0ac9 — the other tracked dist files auto-merged rather than conflicting, and a line-wise merge of generated JavaScript is not something to trust on its own -- the canonical rebuild is what makes them correct, not git's resolution
• r-rebuildopensdamaged 70dc155 — this covers a full-text table that will not rebuild. Damage that makes createSchema or the first meta read fail still surfaces through the open's own catch, which is where it belonged already; nothing here widens that
• r-initsayswhatitpinned c7de40d — the report names the pinned version and the newer one, but not whether the pinned checkout is intact -- doctor compares the running build against the pinned one and is where that question belongs
• r-upgradeperforms b1e75c9 — nothing here can tell a current that resolves to the right tag over a checkout whose contents are wrong. install.sh verifies a reused checkout's manifest and tag, and doctor compares the running build against the pinned one; step 4's failure text names doctor for exactly that reason
• r-doctorreleasefreshness 174e120 — latestReleaseSync cannot signal a process group, so a git that spawns an SSH client which then hangs is bounded by spawnSync's timeout on the child alone. The async path exists because the notice cannot afford that and this report can
• r-passiveupdatenotice a783a95 — the notice speaks only when a check has already landed, so on a cold cache the first invocation says nothing however out of date it is. That is the trade the zero-latency property buys, and the answer arrives on the next command rather than the first
• r-upgradereadonly ccc634c — upgrade accepts --check but performs no upgrade in this build, and --check is therefore the only behaviour. T-1606 makes the bare form act; until then the command names the install line rather than running it
• r-integrityoffread 2584678 — commitlore index --rebuild still cannot open a structurally damaged index -- openIndex rebuilds the FTS table on open and throws first (commitlore index --rebuild cannot open the index it is meant to rebuild #785). That predates this change and the documented remedy has never run in that state; test/index-corruption.test.ts opens the database directly to work around it and says so
• r-pluginawaredelivery 46c4169 — this does not clean up dual installs already on disk -- somebody in that state keeps paying twice until they remove one by hand. It also reads Claude Code's private state, which has already changed shape once (the registry is on version: 2); when that breaks, it breaks toward writing the hook, which is the direction chosen on purpose
• r-hookmatcherunify fa4373d — neither installer knows the other exists -- init writes the settings.json hook unconditionally, so a user who follows the README to the plugin and then runs commitlore init carries two PreToolUse hooks running the same command. Unifying does not create that double fire, but it widens the overlap from Edit and Write to all five; the partial overlap it replaces was worse to diagnose, because the same user saw records twice on an edit and once on a read
• r-rebuildschema a6d577e — this recreates the file whenever the recorded version differs, so a downgrade discards an index a newer build wrote rather than reading what it can from it
• r-partialsilence 9553e2c — this says the scan was cut short, not which records were missed -- the payload cannot name what it never read
• r-rel114 9692b6d — the README restructure and the mobile hero redesign are not in this release, so the four READMEs remain long and the hero's labels remain small at 375px
• r-oneblock 308be65 — the block moved out of the surface most readers see, so a benchmark number now costs one click to reach
• r-builderpin cb1515f — nothing checks that the pinned digest still exists upstream, so a digest deleted from the registry surfaces as a build failure rather than as a clear message
• r-onepointer a3d3b95 — a reader in the upgrade section now has no inline route to the generation table, only to the command that names the affected repositories
• r-ssotfive 9cff5ac — the translated sections were written to match the English contract rather than translated from it, so a later edit to one has no mechanical way of reaching the other three
• r-canonmerge761 6a88f2f — this proves the bundle matches this tree; whether this tree is what a reviewer wants is what the pull request is for
• r-rel113 17a1301 — #749 question 1 stays open -- a fix that lives in the hook reaches a repository only on its next visit, and nothing on this machine knows which repositories exist
• r-koregdrift ca4f99b — nothing checks this -- the rule lives in the PR that established it and in a comment, and the next section written in the wrong register will land the same way these did, from a branch that never touched the file the rule was recorded on
• r-kohumanize 8e9cb09 — terminology is still doubled in places (path/경로, host/호스트, wiring/배선), and that is translation-consistency work that has to move ja and zh at the same time; one connective comma survives behind bold markers where splitting would make the span cross a sentence
• r-heromeaning 9c85ad4 — nothing checks that the hero and the payload block below it stay consistent -- the test asserts the inversion is absent, not that the two describe the same record
• r-machinescope e46af2a — this is one check's classification, not a scope field -- another machine-scoped check added later will default to claiming attention again, and nothing here would notice
• r-upgraderebind 49765af — this reaches a repository only when its stub already carries the arm, so one installed before this still needs hooks install once -- the same boundary After an upgrade the hook says "cannot find the CLI" when the CLI is fine and containment refused it #746 recorded, and the reason that command stays the named remedy
• r-protoown cac5cde — the evidence block is the other four-way duplicate and is untouched here -- check-readme-numbers.mjs still owns it in all four READMEs, and moving it is its own change with its own negative control
• r-heroalt22 19969c7 — the two contracts are still enforced in separate files, so nothing fails if one of them is deleted -- the note is what connects them, and a note is weaker than a check
• r-746message 5dda01b — the stub is written into .git/hooks at install time, so a repository wired before this keeps the old text and gets the old sentence until hooks install runs there; installing a corrected release is not enough
• r-746narrow 5dda01b — commitlore.node is only tested for -x, so a recorded interpreter that exists but cannot run this bundle still reaches neither arm and falls through to the absence message
• r-onevisual 5833281 — at 375px the README embeds at width="100%", so the 840px canvas scales by 0.446 and the 18px labels land near 8px -- better than the 1200px canvas it replaces (7.5px) and still under the 12px a caption usually needs; three columns and this copy do not fit under a 700px canvas, so the canvas question is unresolved rather than answered
• r-rel112 ad6fee3 — the readback confirms the link, not that the interpreter behind it runs -- doctor remains the check for that
• r-rel112 ad6fee3 — this repairs the installer; a machine already upgraded to 1.1.0 or 1.1.1 keeps its stale current until the installer is re-run, which is why the note names the command to check
• r-currentlink735 49ca9ff — unlink-and-rename is not atomic, so a reader resolving current in that window sees it missing -- chosen over silently keeping the old target
• r-currentlink735 49ca9ff — this fixes the report and the rename; a host that genuinely cannot symlink still falls through to the versioned-path note, unchanged
• r-detectrule728 f1784ce — this records the rule, it does not enforce it -- a new host added with the wrong test still compiles, and Plant a host fixture in Windows CI so this class can't hide behind an empty runner #722's planted fixture is where that could be caught
• r-detectwhy728 f1784ce — still recorded, not enforced -- a new host added with the wrong test compiles
• r-readmewin111 b396de9 — the claim is Codex, Gemini CLI and Hermes on one machine at 1.1.1 -- claude-code is still notDetected there with its config present, and the READMEs do not promise otherwise
• r-clogherm111 1915356 — the release body for v1.1.1 was already corrected and republished; this brings the in-repository record to match
• r-rel111 8c29f5d — Hermes still fails on that machine for a cause that is not this one and is not yet named (Windows: every detected host fails to wire — the temp filename carries the whole path, and hasCommand cannot see a .cmd #716)
• r-rel111 8c29f5d — a zero-byte .cursor/mcp.json on the tester's machine is a user file; the installer read the file it says it reads and reported the true reason
• r-rel111why 8c29f5d — this changes the note, not the behaviour -- the behaviour shipped in the merged branch and is already covered by artifact:verify
• r-canon720 7bf5b82 — this adds no judgement about the Windows behaviour -- it makes the branch buildable, and the live evidence on the pull request is still the only evidence for that path
• r-canon720b 7bf5b82 — this rebuilds, it does not judge -- the Windows behaviour still rests on the live evidence recorded on the pull request, and Hermes and the first-run probe timeout are still open on Windows: every detected host fails to wire — the temp filename carries the whole path, and hasCommand cannot see a .cmd #716
• r-winargv716 7bf5b82 — Does not change executable-only Claude detection or the pre-existing MCP probe shell path; a new canonical dist rebuild is not included from Windows
• r-winexec716 7bf5b82 — Does not change MCP probing or rebuild generated artifacts.
• r-rel110 d9a041f — this release does not make host wiring work on Windows -- detection still cannot see a .cmd and spawn still cannot run one (Windows: every detected host fails to wire — the temp filename carries the whole path, and hasCommand cannot see a .cmd #716)
• r-rel110 d9a041f — 1.0.0 through 1.0.2 have no CHANGELOG entries; a pointer to the releases page stands in rather than reconstructing them
• r-rellock110 d9a041f — nineteen version surfaces was already wrong before this -- the lockfile makes it twenty-one, and the count is only ever known after the gate says so
• r-relmanifest110 d9a041f — this is the release commit's own repair, not a fix -- the next release will need the same regeneration for the same reason
• r-namefile716 f728e69 — only failures name their file; a successful wire still reports no path
• r-namefile716 f728e69 — this makes the cursor question answerable on the next Windows run -- it does not answer it, and the outcome (failed) was never in doubt
• r-overlay709 7e08cbf — unattended is an input to the effective digest but not to the defaults digest -- M-UX: capture leaves the user's workflow #511's exclusion rests on a file's identity being its own bytes, which an overlay breaks
• r-overlay709 7e08cbf — a broken overlay falls back to the built-in defaults, not to the committed file -- layering onto a policy nobody could read states an effective policy no file states
• r-wintmp716 f0ed513 — this fixes the write, not the detection -- codex, hermes and claude-code failed for the second cause and still will
• r-wintmp716 f0ed513 — no Windows machine has run this fix; the guard proves the name, not the install
• r-dead691 6680425 — install.ps1 line coverage is unchanged -- what ran before still runs
• r-pend710 b452535 — the wording is checked, not the severity — an abandoned draft still warns
• r-rdupgr a3e04db — an upgrade path is documented where the install path is
• r-rel102 25c11ed — an installer-boundary fix reaches nobody until it is released
• r-adr22nm 31f6cf5 — a norm the product serves is not a capability the product claims
• r-v102doc 597dad7 — the file a reader trusts for a fact must hold the current fact
• r-codexok 9021dd9 — a requested integration that failed is not a healthy host
• r-697codx ae6245f — one owner per host step, in the place both installers call
• r-693curr 14909c3 — a hook records a path that does not name a release
• r-693mut2 14909c3 — a rejection test names what does the rejecting
• r-rel101 b65e34f — a distribution-boundary fix reaches nobody until it is released
• r-689host c0e909b — a host is wired or reported undetected, never absent
• r-660plug 5d0e422 — already installed is the upgrade case, never a skip
• r-686skil adbe186 — a permanent config never records a path that belongs to one invocation
• r-682herm 2e64424 — recognition is by field, never by formatting
• r-680ver 47359a1 — an assertion that reads the source it checks proves nothing
• r-rel100 47359a1 — a published install URL must resolve the moment it is published
• r-status550 de514ea — a setting and a behaviour never share one word
• r-590gate 63e48fa — the preregistered verdict is the authority for published M5 figures
• r-g1build 63e48fa — identity travels as version and digest, never as a path
• r-g1e2e1 63e48fa — parity is only measured across process boundaries
• r-gateplan 63e48fa — a plan that lives only in a session is lost at the next compaction
• r-631cov 92c1b37 — coverage describes the index, history describes the sources
• r-638bnd 2607bae — git reports the message's origin, not the commit's
• r-cleanrebuild664 da8948d — the manifest binds dist to committed source, so any uncommitted edit anywhere in src makes a local verification meaningless — this is a property of the check, not of this branch
• r-formatnotmachine661 2cc274d — verified locally only; whether the warning list's numbering also shifts when the check flips is a question only CI answers, because the runners are where the two runs actually diverged
• r-selfscan661 ccab7f4 — ancestry is only knowable while the ancestor lives; a server orphaned by a doctor that has already exited is indistinguishable from any other session's, and is correctly counted as one
• r-liveruntime660 6a221db — ps is the seam, so this reports nothing on win32 and says so rather than claiming a clean machine
• r-committedat650 f077870 — this pins the spelling, not the clock; nothing here makes two gits agree about anything else in %cI
• r-prosetrailer647 30e40c7 — this changes the advice, not the outcome; the commit is still refused, which is correct while git reads the line as a trailer
• r-repointsays629 c7ab87e — this reports the move, it does not verify the new target runs — hooks status owns that check and is unchanged here
• r-childtreediag640 69c98a0 — the diagnosis is printed, not asserted — the next failure explains itself but the step still cannot say which outcome is acceptable
• r-childtreepre640 69c98a0 — windows-latest is the only evidence for this path; nothing here was verified locally
• r-coldstart640 69c98a0 — this measures the launcher's own child; it does not measure when cmd.exe started, so a stall before node is attributed to the same interval
• r-launchernode640 69c98a0 — the earlier commit raising the probe budget to 15s stands on its own measurement — a healthy probe used 4478ms of 5000ms — but its message claimed that budget explained this flakiness, and it did not
• r-launcherwhy640 69c98a0 — the deadline explanation is two independent diagnoses and a margin measurement, not a reproduction — the confirming evidence is the next run's own output
• r-mcpidentity572 69c98a0 — Windows behaviour here rests on windows-latest runs and nothing else; a slower machine than three times the measured passing case will still be told it could not be verified, which is at least true
• r-nodedrive640 69c98a0 — this reproduces the spawn, not the whole probe; a silent result narrows the cause without naming the fix
• r-probefacts572 69c98a0 — the close-stdin outcome is measured, not guaranteed by the shell -- a platform whose shell defers the redirect past the parent's first write would produce the timeout code instead, and this case would then need its own seam rather than a looser assertion
• r-proberace572 69c98a0 — this leaves one outcome unpinned, so a regression that swapped closed-input for timed-out on that fixture would not be caught here -- the four other cases still pin their codes exactly
• r-reclaimnogate640 69c98a0 — windows-latest is the only evidence for this path, and one green run does not settle a race — this needs to hold across runs before The MCP probe's Windows behaviour is unverified: PATHEXT resolution and child-tree cleanup #640 can be called closed
• r-sawinput640 69c98a0 — this records the arrival, not the response; if bytes arrive and nothing comes back, the next question is the probe's reader
• r-slownotbroken640 69c98a0 — fifteen seconds is calibrated against one Windows runner's measurement; a machine slower than three times that will still be told it could not be verified, which is at least now true
• r-mirrorsays632 aafd5ab — this states the retry, it does not verify it — nothing here checks that the following push actually published the note
• r-keyringgen653 8b066c7 — the generation identifies the keys the verifier can list, not every reason git might reach a different verdict; expiry and revocation are outside what this binds
• r-readmecache653 359e0f1 — only the English README carries this sentence; the three translations do not, so nothing is left inconsistent by correcting it alone
• r-preflight002 0dca998 — MCP capture advertisement requires package manifest, SPEC, and schema to be available in the active runtime
• r-recheck002 0dca998 — a readiness answer is only as fresh as the request that asked for it; nothing here prevents an asset vanishing between the check and the work
• r-herosvg643 fc1009b — this renders in the README's first screen, so required wording must stay legible at mobile width
• r-readmefact643 fc1009b — section order, demo asset and exposure table are cross-file contracts over four language files
• r-canon605 f474cf4 — esbuild resolves a platform-specific binary
• r-rel0820 59c6730 — release versions must agree across manifests, lockfile roots, installer pins, and the runtime CLI
• r-epipe595 0d60c75 — the negative control could not be reproduced outside CI -- with the handler removed the suite still passes locally and in a linux container, because the probe reaches its five-second timeout instead of losing the race
• r-hostsay595 0d60c75 — this surfaces what the host command said; it does not diagnose a command that says nothing, and that case is now named as unknown rather than guessed at
• r-oid613 202913c — a source guard allows core/types.ts and rejects a local length copy anywhere else, so a future reader writing its own regex fails rather than silently reintroducing the class
• r-sha256oid 202913c — git object ids are hex, abbreviation 4, full SHA-1 40 or SHA-256 64
• r-522idx1 b0fa907 — a truncated scan must never render as a complete answer; unreadCommits is the existing channel
• r-522idx1 b0fa907 — --no-index and a filesystem that cannot write to .git still fall back to a scan
• r-answerown1 3547382 — warn distinguishes ours from not-ours by the command string, and does not execute anything -- a wrapper that really is a CommitLore server still reads as unverified, which is the safe direction but not a probe
• r-pretag01 86e0153 — registers_commitlore reads the key, so a config that registers under a different key -- a host with its own naming -- still reads as unregistered and is wired again
• r-engfloor01 fe83524 — the parser covers the range shapes npm packages actually publish -- comparators like >=22 <23, and pre-release identifiers, are read by their first version and not by their bounds
• r-dropfake01 06961d3 — the runtime's presence proves this installer wrote the directory, not that its contents are unmodified since
• r-secondcopy1 01ebee5 — the budget bounds the two scans, not the command -- process startup, path resolution and rendering still sit outside it
• r-staleclaim1 59cb5d9 — withholding uses the same pattern table as every other route, so a payload that trips nothing still passes; this closes a route that had no grading at all, not the heuristic behind it
• r-nodefloor1 f4c924f — this bounds the version, not the feature -- a Node that ships node:sqlite behind a flag, or removes it, is not detected here
• r-release081 ffe702a — the capture half reaches a host that surfaces MCP instructions; one that ignores that field still needs --agents-md, and nothing detects which kind a host is
• r-observed01 43cfa5e — existence is not identity -- a path that resolves to something other than this tool still reads as a working registration, which is doctor reports a registered MCP command as working without establishing its identity #572
• r-ownsemver1 fcc6e4a — the evidence is a directory this installer wrote, so an install whose data directory was deleted is now refused rather than upgraded -- a refusal naming the file, against silently destroying it
• r-saywhat01 56444db — entailment is still unchecked, and this narrows the claim rather than closing the gap -- the protection remains that no drafted record is ever delivered as a directive
• r-bynottname1 8beaa6d — an entry whose command is launchable but wrong still counts as a registration; the check establishes that a host could start something, not that what it starts is this tool
• r-winstall1 0b4e551 — this pins what the repository says about itself, and cannot check that the tag it names has been published -- the install gate does that, after the tag exists
• r-vbind001 2c88d24 — this binds the requested tag to the runtime that answers, not the tag to its content -- a tag moved after publication installs whatever it now points at, which is a signing question rather than a version-binding one
• r-insttxn1 afb7bfb — this establishes that the installed tree is complete and its commands run on this machine at this moment -- not that the machine will still have a working node tomorrow, and not that any agent host will load what was installed
• r-authdir01 ae2a66f — in the default mode a directive establishes that the commit's author string matched a configured one, and nothing about who produced the commit
• r-authdir01 ae2a66f — in signature mode a verified signature establishes that a key the verifier trusts signed this commit -- not that its holder has authority over this repository, and not that the record's content is true or safe
• r-codexreg1 5933aa4 — an entry can be correct when the installer reads it and wrong afterwards -- a later install, a moved data root or a hand edit all leave the name intact, and nothing revisits it until the installer runs again
• r-codexplug e5fe95a — a plugin can put a skill in front of a session; it cannot make the session follow it, and nothing here reports whether one did
• r-readme001 7f82d47 — the README still cannot tell a reader whether their particular host will follow a written procedure; only the hosts with a plugin or an installer have that answered by a mechanism rather than by hope
• r-hermesx01 2eb8176 — hermes skills inspect resolves remote sources only in this Hermes version, so discovery was verified through hermes skills list --source all in a fresh isolated profile rather than from inside a live conversation; that a session then follows the procedure is not something an installer can establish
• r-codexwire 955f290 — an instruction file is guidance, not enforcement -- a host may ignore it, summarise it away, or never read it, and nothing here can tell whether any session followed the procedure
• r-cdeb10reg 48bd5a8 — wrong-path viability, deterministic oracle feasibility, code disclosure, bounded implementation, and unproven ordinary or benchmark authorship cannot be decided from history and remain undecided for human review
• r-cdeb08an 60db89f — the paired bootstrap describes resampling stability within these five frozen repositories and thirty frozen tasks, and says nothing about any other repository, task or agent population
• r-unattshadow b7b532a — together the two features measure how often an unattended pipeline would have written, and remove the asking from the writing -- neither half can say whether what gets written is worth a reader's attention, so shadow's number for an unattended repository is a volume, not a value
• r-retireserena c1171ef — the preregistration fixes claims before numbers exist, so what it says about the calibration cannot move to match later tree state
• r-readmeorder 383f77d — the hook leads with the headline number, so a reader who stops there has the effect without the conditions on it; the section naming those conditions is now two screens up rather than at the end, which is a shorter path than before but still a path
• r-m5sources b910dba — the seven shards are declared individually, so a shard added later is invisible to this block until someone lists it -- which is the property the declaration was built for and the cost that comes with it
• r-rel071 af8e0ab — 0.7.0 stays published with its notes amended to name the defect at the top; retracting a tag people may already have installed trades a known-bad version for an unknown one
• r-rel070 d4a4d8b — the README's behaviour claim now rests on M5 while the generated numbers block beneath it still publishes M4, which is The README's generated numbers block still publishes M4; M5 measured the thing the README leads with #480 rather than a release-time edit
• r-numgate b770054 — the README's behaviour claim and the generated block below it now describe different studies until The README's generated numbers block still publishes M4; M5 measured the thing the README leads with #480 lands
• r-readmem5 6d04c0b — the README now leads its behaviour claim with a [claim]-tier number while shipping a [directive] tier nobody has measured, and that gap will widen until something measures it
• r-clog070 172fa3d — the entry stays under ## Unreleased and names no version, because the version bump belongs to the release commit and a changelog that pre-announces a number can be wrong about it
• r-readmecold 08efdff — only README.md is reordered, so the ko, ja and zh-CN readers still meet the evidence first until the follow-up lands
• r-selfaudit cd0068f — the page is maintained by hand, so an entry can go stale against the code it describes; the closing line says so and asks for an issue when it does
• r-cdebver01 ce7b278 — the schemas freeze protocol 1.2.0 constants -- thresholds, matrix size, category names -- so a protocol change is a schema change and CI notices
• r-claimsmatch 506ada4 — this fixes the sentences an external reviewer found; no systematic pass was made over every claim in the four files against every published measurement
• r-m5analysis 3450656 — the script enforces the row count, not the identity of the rows; a run that produced 1,160 rows under a changed harness would satisfy it, which is what harness_commit and dist_digest on each row are for
• r-benchscope 67f4375 — nothing checks the shape of the eight metric-row files. This gate names them and steps over them, and bench/deterministic/types.ts is the only definition that family has -- there is no JSON schema for it, so drift on that side is still invisible
• r-benchscope 67f4375 — the pre-provenance exemption reads started_at, which is data on the row rather than a fact about the file. A row that misreported it would be held to the shorter list of requirements; that is a deliberate falsification rather than the omission this fixes, and nothing here detects it
• r-priorart 507ae24 — the comparison is against Lore's README and its abstract; the full paper was not read, so a lifecycle described only in the PDF would have been missed
• r-scaleproof 4c093f2 — the 100,000-commit figures come from a synthetic repository built by the deterministic harness, not from a real codebase of that size, so they describe the index's shape rather than any particular project
• r-extbaseline 064daf6 — the band is four Python repositories chosen for having enough revert history to backfill from, so it is evidence about large long-lived Python projects rather than about repositories in general
• r-3c9d52 dc9e769 — the sweep is two git log calls per path and the delivery phase runs git log --follow on every tracked path, so a full run over the four externals is hours rather than minutes on one machine
• r-ledgerresult bc31c90 — both sides are byte-derived proxies under CHARS_PER_TOKEN=4 rather than a provider tokenizer, so the ratio cancels a uniform error and not a differential one between diff text and prose
• r-ledgerresult bc31c90 — break-even in reads assumes reads land on the evaluation set the way the delivery run's per-path average describes, and real editing concentrates on a few files
• r-surfacedeliv fae9e1e — every figure in the table is measured on this repository measuring itself, which is the weakest part of the evidence and is stated in the paragraph rather than left for a reader to discover
• r-rel060 e999b9d — the install one-liner in all four READMEs now points at a tag that does not exist until this is tagged, so the window between merging to main and pushing v0.6.0 is one where the documented install is broken
• r-pipesplit b4fa571 — test/dogfood.test.ts validates every record in this history, so a new violation class is only available if it rejects none of the 620 Ruled-out: values already written
• r-readmesplit344 7314a03 — three checks bind content to a position in the README, so the complete record example, the protocol vocabulary table and the generated benchmark block could not move
• r-failopen abc54ea — with the gate installed and no CLI resolvable, commits are still refused -- that is the one hook holding a verdict back, and this change does not reach it
• r-heropolish f6144bc — README.ko.md still switches from 존댓말 to 해라체 below the hero; that split is older than this change and belongs to the restructure in README still carries the reference manual it should be linking to #344
• r-pluginpath353 e364f3a — a plugin manifest has no way to add anything to PATH, so no plugin-side change can make the documented commands resolve
• r-realoutput f9efea0 — a README block introduced as what the tool prints is a behavioural claim, and inventing its shape is the same defect as inventing a number
• r-release051 19810d2 — the hook is written at install time, so no release repairs a repository that already has one; every release touching hook behaviour has to restate what does
• r-heroinherit 89b13ac — a headline that implies detection commits the product to guard's numbers, and guard is an advisory measured at 22% recall
• r-convertreadme e12c816 — a README claim about the default workflow is only true if the shipped skill performs it, and the skill currently requires the user to name CommitLore first
• r-fieldreport 753f4e7 — this section reports one engineer's day on one repository; it is evidence that the mechanism works there, not a measured effect size, and the wording has to keep those apart
• r-readmefinal 40aeae0 — a mutation oracle anchored on a claim that can become false will silently stop testing when the claim is removed; the needle has to be asserted present
• r-release050 ad402c7 — the hook is written at install time, so a corrected release never reaches a repository that already has one; every release fixing hook behaviour has to say what repairs an existing install
• r-compat1122 e7d8516 — a non-empty guard does not detect deletion; each table's row keys have to be asserted as a set or the statement can silently shrink to one row
• r-compat1122 e7d8516 — substring comparison hides a narrowing -- ./ is inside ../ and Edit|Write is inside Edit|Write|MultiEdit|NotebookEdit -- so cells are compared as their rendered form
• r-compat1122 e7d8516 — a sentinel containing \0 makes git treat the file as binary, which costs it diff, blame and log -p permanently
• r-compat1122 e7d8516 — the plugin path needs bash, because scripts/commitlore-run.sh carries a #!/bin/bash shebang, and no install script checks for it
• r-muslbullet1126 04ac181 — this ticket owns four bullets and not the tests that read the section around them, so a check that breaks here means a region was taken that was not allocated
• r-ps1stderr282 e37b4d3 — Windows PowerShell 5.1 turns a native command's stderr into a terminating error under $ErrorActionPreference = Stop, so no native call in this script may merge stderr into its output
• r-t1120nodeinst 14deeb4 — git and node are hard prerequisites now, so a host without them installs nothing and says which one is missing
• r-gateb3rev a2e38b9 — the shipped install.sh downloads a platform asset, so no document may describe it as Node-only until the installer itself changes
• r-rel041notes 71efe1f — 0.4.1 makes the installer honest about a verification it cannot complete rather than fixing the kill, so an upgrading user may still see the unverified message instead of a version
• r-instverify256 3715677 — the root cause of the signal kill is unestablished; this makes the installer honest about it rather than fixing it, and Documented install exits 137 on upgrade: a killed verification turns a successful install into a failure #256 stays open for the cause
• r-rel040pins b76c40b — the pin names a tag that does not exist until the tag is pushed; between this merge and that push the documented command refers forward
• r-rel040notes 5d57a72 — the 26.3-point density gap quoted in the notes is measured at this head and will drift with merge volume; it is illustrative of the denominator problem rather than a stable figure
• r-t1016svg 321c6f1 — byte-exactness is verified on this platform; a different platform's Node could in principle render differently, and nothing here proves it does not
• r-t1021known 8dfffc1 — the figures are measured against one archived 417-decision corpus, which is deliberately hard and is not deployment prevalence
• r-pin030readme 504b54e — install.sh must already support tag-based download for the one-liner to work; verified that the URL resolves to a tagged tree
• r-notes030 a289ca5 — the density denominator is named here and in the handoff, not in the harness that emits it, so the next run reproduces the same ambiguity
• r-hero172a bc0d971 — Stale-exposure benchmark is one corpus, one query, and one pinned embedding model at a fixed two-record budget
• r-be140cost 8c01bd5 — no per-turn provider token ledger or observed avoided-work cost exists yet
• r-readme129 ab5f210 — the break-even rests on tokens estimated from bytes at the product's own four-characters-per-token constant, so it moves with that assumption
• r-m4basis 5e2d2cb — the guard question stays unanswered until the exposure instrument is verified and M4 is rerun on it
• r-m4withdraw e5f9b73 — the guard question is now unanswered rather than answered null
• r-instpath119 9e1fce7 — a user who ignores the printed line still gets "not found" on the next command
• r-readmeux1 b664205 — interactive record building does not exist, so the honest answer is still "an agent writes it or you do"
• r-rel021a a79e350 — v0.2.0 remains on the remote with no release attached
• r-expreadme1 9e69abe — bench/VERDICT-M4.md still cites the Fisher figure; the two disagree until the verdict records why the number was withdrawn from the README
• r-expomerge1 d6ad014 — M4's existing rows have no exposure field and must read as unknown, not as not-exposed — backfilling by inference would erase the finding
• r-f61a2c 9114cf0 — the matcher remains deterministic and lexical; no embedding or semantic service is available to distinguish paraphrases
• r-rdme96a 9c9371c — scripts/check-readme-numbers.mjs's withdrawal-notice and stray-statistic checks constrain what can appear outside the (absent, here) generated benchmark block — re-checked after every edit, not just at the end
• r-fix92dupid 7f41a6e — cross-references between two blocks declared by the same commit (a Follows:/Supersedes: naming a sibling block's id) are still reported as dangling rather than resolved against the sibling -- unchanged from before this fix, and called out in validate.ts's own comment as future work
• r-fix93pkg 9c4a396 — package.json remains a development artifact (build, typecheck, dependency floor) -- it is not read as a distribution manifest by anything in this repository
• r-relinstall c6e1d04 — never tested against the real GitHub release infrastructure (no release exists yet — that is the owner's action) — verified against a locally built SEA binary, a hand-made SHA256SUMS, and a local HTTP server standing in for GitHub's release-asset redirects, which is everything this repository lets a change verify before a tag exists.
• r-distrace88 d118a73 — the fix insulates bench-ablation.test.ts from the race; it does not remove the underlying design (four test files independently, redundantly rebuilding one shared dist/ in their own beforeAll). A fifth file doing the same thing, or a future check elsewhere that also depends on dist/'s mid-run stability, can still race the same way.
• r-parsemulti 6d39d25 — parse has no git-commit context (no sha, no notes mirror) — its identityCollision check is local to the one message being parsed and cannot detect a Record-Id that collides with something already committed elsewhere in history the way context's fold does.
• r-multirec01 92aeb24 — parseRecordBlocks only recognizes a non-final block by its declared Record-Id, so an unidentified inherited record beyond the first stays recoverable in the plan that computed it but not in a later re-parse of stored text; squash-preserve orders unidentified blocks last so the common case (at most one) is unaffected.
• r-multirec01 92aeb24 — multi-block reference checking (Follows:/Supersedes:) does not resolve one block's reference against a sibling block declared by the same commit; each block is still checked against every earlier commit in history.
• r-exit065 e545dee — any new command's exit codes must be drawn from SPEC §10, not invented locally
• r-fix70a1 d707fc7 — one encoding layer and explicit lexical forms in the four published languages; semantic paraphrases, nested encodings, and split payloads remain outside coverage
• r-shallow66 60a8659 — a depth-1 clone can only inspect its reachable commit history
• r-det058 695cdf6 — the suite must need no model, agent, network or uncommitted benchmark input
• r-7a3e91 cf859e4 — better-sqlite3 stays external because it is native — the bundle degrades to --no-index without it, which only works because r-6f2a08 made that load lazy first
• r-9c07e2 9c4d25a — the plugin still needs Node for the CLI — the protocol does not, but guard, the index and the MCP server do (T-706 · Bundle the CLI as a single file — run from a clone alone #38)
• r-9c2f74 d653153 — the ablation arms cannot discriminate on these fixtures -- no-grade and no-lifecycle are byte-identical to the treatment in 9 of 10 tasks, because the seeds carry one reconstructed record and one task with a lifecycle trailer between them
• r-9c2f74 d653153 — the harness assembles its own projection rather than calling the shipped injector, so what is measured is the harness's rendering of the records, not src/core/inject.ts (issue B-08 · Replace the benchmark harness injector with the actual src/core/inject.ts #36)
• r-4a8e15 49e12c7 — git's grammar requires a subject before a trailer block, so a serialized block is not by itself a parseable message
• r-6e1a72 5e09846 — npx commitlore is the first thing a reader will try, and it fails until the package is published
• r-7e5f02 e5f5e00 — npm installs through an engine mismatch, so the ecosystem's own signal cannot be relied on to stop anything
• r-7f0e39 76f3f2d — literal substitution only catches the exact strings you list, so the same term written with a different separator survives
• r-5a8c04 c46a577 — git owns the definition of a trailer block, so any behavior we cannot get from interpret-trailers is behavior we must not invent
• r-9d31b7 4ac6e30 — the example lives in four translated files, so any fix that is not mechanically enforced will drift again on the next edit
• r-c0f4e2 3d249cd — npm gitlore is held by an active same-domain CLI, so the owner's first-choice name was not available
• r-b2e7f1 00d348d — Parsing must delegate to git interpret-trailers -- reimplementing the block rules would drift from the rest of the git ecosystem
• r-a8f3c1 ef48843 — Rename must land before any code exists -- after 27 tickets it would touch spec, fixtures, index, hooks and every doc

Ruled out (321)

• r-currentlink735 49ca9ff — keep mv -f and only add the readback | the readback would then correctly report failure on every BSD upgrade, which is honest and still broken
• r-detectrule728 f1784ce — give claude-code a config-directory fallback for symmetry | it would report a host detected and then perform no wiring, which is the false success this installer exists to avoid
• r-detectwhy728 f1784ce — give claude-code a config-directory fallback for symmetry | it would report failed and set ok false on a machine whose only trace of the host is a leftover config, failing an install that had nothing wrong with it
• r-readmewin111 b396de9 — leave the row and add a Windows-only footnote | the row is what a reader checks first, and a footnote does not repair a sentence that reads as exclusion
• r-clogherm111 1915356 — leave it and correct it in 1.1.2 | a note that misreports which hosts work is read by everyone deciding whether to upgrade, and it was wrong in the direction of underselling a fix that landed
• r-rel111 8c29f5d — claim Windows host wiring works | two of the four detected hosts wire, and a release note that rounds that up is the false green this release exists to remove
• r-winargv716 7bf5b82 — shell: true | wrapper and user paths would become a shell injection surface
• r-winexec716 7bf5b82 — shell: true | wrapper and config paths must not become unchecked shell input.
• r-rel110 d9a041f — fold the second Windows cause into this release | it arrived as Fix Windows host resolution and batch spawning (#716) #720 with real Windows evidence and needs its own judgement, and holding this back would make the note about what is still broken false in both directions
• r-rellock110 d9a041f — replace the version string throughout the lockfile | it matches four dependencies that are really at 1.0.2, and nothing in the suite would have caught it
• r-namefile716 f728e69 — add a path field to HostResult | the summary schema is pinned at v1 and detail is already the free-text field a human reads
• r-overlay709 7e08cbf — let an overlay only narrow permissions | it solves the contributor who wants less, and the one who wants more still edits the tracked file, which is the reported failure
• r-overlay709 7e08cbf — write a .gitignore entry for the overlay | a tool that hides a file on a repository's behalf has decided for the repository what it may not see
• r-wintmp716 f0ed513 — use basename() | correct on Windows, unfalsifiable on the platform CI actually runs
• r-dead691 6680425 — keep the blocks until a Windows machine confirms wiring | they sit after an unconditional exit, so no run can distinguish their presence from their absence
• r-pend710 b452535 — drop the warning for the non-staged case | a stale draft is still worth surfacing, and doctor reports a consumed capture as never written to history #584 already showed that going quiet on a healthy-looking path is how this check loses its meaning
• r-cleanrebuild664 da8948d — rebuild again and hope | the first rebuild was real; what was wrong was the tree it read, and running it once more from the same tree would have produced the same mismatch
• r-formatnotmachine661 2cc274d — revert Report the MCP servers that are answering, not the ones registered #661 | it would take the check and its regression back out, and rebuilding both costs more than the line this change adds while main stays red
• r-selfscan661 ccab7f4 — mark the probe's child through the environment | ps reports arguments, not environment, so the marker would be invisible exactly where the decision is made
• r-selfscan661 ccab7f4 — exclude by direct parent only | the server is a grandchild of whatever probed it, so one link is not the relationship that matters
• r-liveruntime660 6a221db — rebase the original branch | it predates the probe rewrite and the sidecar, so 29 of its conflicts were in code those changes already resolved differently
• r-liveruntime660 6a221db — compare reported versions between runtimes | a copied or stale install can declare the same version as a current one, so equality there proves nothing about identity
• r-liveruntime660 6a221db — canonicalise the totals line in the snapshot | it would hide a real change in the check set behind a token, which is what that snapshot exists to catch
• r-pinnedreport660 6a221db — canonicalise the totals line as well | it would hide a real change in the check set behind a token, which is the thing that snapshot exists to catch
• r-pinnedreport660 6a221db — leave the check out of the default registry to keep the report stable | a check nobody runs reports nothing, and the stale runtimes it names are on real machines rather than in fixtures
• r-committedat650 f077870 — normalise every timestamp to UTC | an offset carries where the commit happened, and discarding it to gain uniformity loses a fact the record is entitled to keep
• r-committedat650 f077870 — canonicalise at the JSON boundary only | the index stores the same field, so the two routes would then disagree with each other rather than with git
• r-prosetrailer647 30e40c7 — treat sentence-like lines as prose rather than trailers | SPEC §2.1 B3 gives git the trailer boundary, and re-deciding it here would make our parse and git's disagree about the same message
• r-prosetrailer647 30e40c7 — enforce key validity only when every line in the block parses as Key: value | same objection, and it would silently stop validating a mistyped Record-Id sitting beside a prose line
• r-prosetrailer647 30e40c7 — a multi-word value alone as the prose signal | measured against the conformance fixture, which it misclassified — the fixture caught the heuristic, and the heuristic changed rather than the fixture
• r-repointsays629 c7ab87e — drop the word unchanged | the file genuinely is unchanged and that is worth saying; the defect was that it was the only thing said
• r-repointsays629 c7ab87e — report the recorded target on every install | on a first install there is nothing to compare against, and a line that always appears stops carrying information
• r-bundleprobe636 69c98a0 — sidecar MCP helper | it is outside the declared single-file runtime
• r-childtreediag640 69c98a0 — guess between the two suspects and change the fixture again | the previous change was a reasonable guess that did not hold, and a second guess costs another Windows round trip with no more information than the first
• r-childtreepre640 69c98a0 — weaken or delete the failing step | it is the only coverage of Windows child-tree reclamation in the repository, and no unit test touches taskkill
• r-coldstart640 69c98a0 — read the node-spawn driver's silence as proof the spawn loses bytes | it shares the same five-second window, so slowness would make it silent too and I would have read a timing result as a delivery result
• r-initiator636 69c98a0 — asset readiness preflight | F-002 and prepare_capture fails with ENOENT on a dev-hash asset root that is never installed #633/commitlore_prepare_capture fails with ENOENT on a 0.6.0 spec path; the Claude plugin cache only has 0.8.0 and the codex cache has 0.8.2 #635 own that separate runtime check
• r-launchernode640 69c98a0 — keep the hard-coded path and widen the timeout | no budget reaches an interpreter that is not on disk, and three attempts had already shown that
• r-launchernode640 69c98a0 — treat this as the product defect | a registration naming an interpreter that does not exist should be reported unhealthy, and the probe running the registered command verbatim is the behaviour to keep
• r-launcherwhy640 69c98a0 — revert to the hard-coded path | it works on this image and testing against the Node the job installed is still the more honest fixture; the correction here is to the reason, not to the code
• r-mcpid572 69c98a0 — a separate MCP protocol probe | reuse the Both installers still skip a host whose registration cannot run, and exit 0 #595 implementation to prevent drift
• r-mcpidentity572 69c98a0 — widen the budget and keep the wording | the message would still send an operator to repair something that works, just less often
• r-mcpidentity572 69c98a0 — retry the probe | a retry pays another full budget to answer a question the first attempt already answered, and doubles doctor's worst case
• r-mcpidentity572 69c98a0 — gate the child-tree assertion on the server being healthy first | reclamation runs on every probe exit including the timeout, so requiring health made the precondition depend on the behaviour under test and could not tell a broken product from a broken fixture
• r-nodedrive640 69c98a0 — instrument mcp-probe.ts itself | product code should not carry diagnostics for one platform's fixture, and the mechanism is reproducible without touching it
• r-probefacts572 69c98a0 — accepting either code in one case | it makes the regression pass whether or not the probe still separates the two facts, which is the property under test
• r-proberace572 69c98a0 — accepting either code in both fixtures | that is what makes the pair meaningless, since neither would then hold its own fact
• r-proberace572 69c98a0 — forcing determinism by having the fixture signal readiness before closing stdin | the probe writes immediately on spawn, so there is no point at which a fixture could report ready first without changing the protocol
• r-probesync572 69c98a0 — treating stdout as completion | spawnSync waits for helper exit after stdout
• r-reclaimnogate640 69c98a0 — keep gating on probe status and retry the step | the gate races on cmd.exe stdin ownership, so retries would convert a real signal into a slower coin flip
• r-reclaimnogate640 69c98a0 — mark the path unsupported | reclamation is implemented and unconditional in the source; what was missing was a test that could reach it
• r-sawinput640 69c98a0 — drive the wrapper through a pipe instead of a file as the discriminator | PowerShell closes the pipe after writing, so it would test EOF rather than the held-open pipe the probe uses
• r-slownotbroken640 69c98a0 — widen the window and keep the wording | the message would still tell an operator to repair something that works, just less often
• r-slownotbroken640 69c98a0 — retry the probe | a retry pays another full budget to answer a question the first attempt already answered — the server was not reached in time — and doubles doctor's worst case
• r-slownotbroken640 69c98a0 — keep the sidecar's outer bound as a constant | it was 7000ms against a 5000ms budget, so raising one without the other would kill the helper before it could answer and report that death as the server's fault
• r-stub572 69c98a0 — retaining the fixed one-line stub | it is not an MCP server and the new probe correctly rejects it
• r-trimdiag640 69c98a0 — keep the drivers for the next investigation | they are cheap to write again from the pull request comment, and a permanent cost for a question already answered is the wrong trade
• r-winprobe640 69c98a0 — process manager framework | taskkill is a bounded Windows helper
• r-mirrorsays632 aafd5ab — fail the push when the mirror cannot be published | a record that could not be mirrored is not a reason to withhold code, and the hook's contract is that it never blocks
• r-mirrorsays632 aafd5ab — keep one sentence and lengthen it | the two outcomes need opposite actions from the reader, and one sentence covering both is what left it silent on the actionable half
• r-keyringgen653 8b066c7 — memoize the generation per process | a long-running server would keep grading against the keyring it started with, which is the shelf-life defect just removed from the MCP capture gate
• r-keyringgen653 8b066c7 — stop caching signature_status | it is read per graded record, and recomputing it per query costs the git log the index exists to avoid
• r-readmecache653 359e0f1 — wait for the F-001 follow-ups to avoid a conflict | main states something false about when a record can be trusted, and every hour of waiting is an hour of holding it
• r-f002onf001 0dca998 — keep the local packageVersion reader | it is a second answer to a question F-001 now owns, which is the divergence this pair of findings exists to remove
• r-preflight002 0dca998 — code-only tool advertisement | a stale runtime can expose capture after its SPEC is gone
• r-recheck002 0dca998 — keep the startup snapshot and document the limitation | the runtimes this finding came from had all outlived their snapshot, so documenting it would describe the defect rather than remove it
• r-recheck002 0dca998 — a filesystem watcher or a daemon | a stat at the boundary answers the same question without a process to supervise
• r-oneinstall001 31cf0d1 — filename equality | two shipped entrypoints of one install are one runtime
• r-runtime001 31cf0d1 — version-only comparison | equal version strings still allow different entrypoints and package roots
• r-runtime001 31cf0d1 — filename equality | two shipped entrypoints of one install are one runtime
• r-readmefact643 fc1009b — Restructure the English product entry page alone | T-1015 and T-1016 enforce four-file consistency and the translations belong to The README cites a checker that does not cover its headline numbers, and they disagree with the generated block #590
• r-signer597 3dc75e7 — signer email or author header matching | either is commit-controlled metadata and does not bind the verified key to repository authority
• r-canon605 f474cf4 — remove the legacy dist sidecars now | that changes test harnesses and needs a separate reviewed reduction
• r-rel0820 59c6730 — rebuild dist | the CLI reads package.json at runtime and a rebuild changes the bundle digest without changing behaviour
• r-epipe595 0d60c75 — swallowing the write failure silently | the probe would then wait out its full timeout for a command already known to be gone, and report a timeout rather than the closed input that actually happened
• r-hostsay595 0d60c75 — letting stderr flow straight to the terminal | it interleaves with the wrapper's own output and is lost entirely when a caller captures only stdout, which is how this went unnoticed
• r-install595 0d60c75 — presence-only registration checks | they allow dead commands to report installation success
• r-linuxcwd595 0d60c75 — changing installer runtime verification | Linux evidence showed the smoke-test failure came from the linked-worktree test cwd
• r-oid613 202913c — keeping one {4,64} predicate and calling resolveRevision first at every site | the predicate is what persists, and a call-order convention that must hold at eleven sites is a habit rather than a contract
• r-oid613 202913c — tightening the Provenance trailer grammar to full ids here | that invalidates records already written and needs a SPEC and schema revision, which is a different review from a bug fix
• r-sha256oid 202913c — a second full-id regex of 40-or-64 | that is a third definition, and the remaining sites stayed 40-only because they did not share the first one
• r-522idx1 b0fa907 — leave context on the no-build scan fallback | a second call on hermes-agent was 271s and index.db was still absent
• r-engfloor01 fe83524 — adding semver as a dependency to parse this | one regex over a handful of published shapes does not justify a runtime dependency in a check that runs before install
• r-ownsemver1 fcc6e4a — keeping the semver rule and warning instead | the failure is destructive and silent, and a warning printed after the file is gone is not a warning
• r-vbind001 2c88d24 — deleting a checkout that fails the version check | a directory the installer cannot identify may not be its own, and refusing costs an operator one command while destroying it may cost them something unrecoverable
• r-insttxn1 afb7bfb — treating "verification could not run" as fatal | it fails a good install over a missing optional tool, which is the failure the non-fatal policy was introduced to stop
• r-authdir01 ae2a66f — requiring signatures by default | it would demote every existing repository's records for a risk this project is not currently exposed to, and a silent capability removal on upgrade is its own kind of dishonesty
• r-authdir01 ae2a66f — deleting the directive tier to make the claims true | the tier is how a record says it is a constraint, and removing it would resolve the wording by removing the feature
• r-relfix01 96102b4 — keeping "floor, measured" and footnoting it | the sentence is the claim a reader takes away, and a footnote that contradicts it is worse than either alone
• r-codexreg1 5933aa4 — replacing any entry named commitlore | a user may run their own server under that name, and taking it because the name matched is the failure this fix is about, pointed the other way
• r-readme001 7f82d47 — deleting the evidence and audit material to shorten the page | the willingness to publish unflattering results is the asset, and shortening by removing it would trade the strongest thing here for a faster read
• r-hermesx01 2eb8176 — writing the bundle into the profile directory and regenerating its manifest | it would be undone by the next sync and disagree with the manifest until then
• r-codexwire 955f290 — a Codex-specific integration | the instruction surface is shared, and writing one integration per host would leave the same gap open for the next five
• r-cdeb08an 60db89f — discovering row files under the result directory | an unregistered file contaminates the matrix while leaving every stopping rule looking satisfied
• r-cdeb08an 60db89f — filling or dropping unavailable usage | both change a token aggregate without evidence, one by inventing a number and one by redefining the population
• r-unattshadow b7b532a — keeping the unattended branch's inline prepare body | the shadow refactor exists so both entry points share one side-effect-free half, and two copies of the same hashing and policy logic would drift the first time either changed
• r-unattshadow b7b532a — checking unattended consent in the live path only | the refusal for mode "off" already lives in the shared half of prepare, and a consent check that guards one door but not the other is no guard for the next entry point added
• r-retireserena c1171ef — rewriting the evidence documents to match the retirement | the transcripts and the preregistration report what the recorded runs saw, and a published claim the evidence does not support is the defect class docs/SELF-AUDIT.md exists to catalogue
• r-retireserena c1171ef — keeping the ignore entry and the test guard as cheap insurance | the record that justified them said the directory comes back while the tool runs; it no longer runs, and a guard for a tool nobody uses guards nothing
• r-retireserena c1171ef — editing r-strayserena in place | a record lives in the commit that declared it; retirement is a new record that names the old one
• r-readmeorder 383f77d — cutting the positioning prose rather than moving it | it answers the second question a reader has, and a document that only shows the example leaves them without the frame for it
• r-readmeorder 383f77d — keeping "Known limitations" as the heading to avoid touching the test | the heading is the reason the section went unread, and a test that pins a name is meant to keep the disclosure honest rather than to keep the name
• r-m5sources b910dba — globbing bench/results for m5-*.jsonl | the file next to them is a withdrawn design log, and a glob is how the wrong dataset gets published without anyone deciding to
• r-m5sources b910dba — reporting only the 1,160 and dropping the row count | the rows are on disk and a reader who counts them would find the block understating; naming both and the reason is what makes either checkable
• r-rel071 af8e0ab — deleting the v0.7.0 tag and re-cutting it | rewriting a published ref breaks every clone that already fetched it, and the release notes can carry the truth without that
• r-rel071 af8e0ab — reading the flag with a nullish check and documenting the commander default | the documentation would sit in this file while the defect sits in every install, which is the arrangement that produced this
• r-rel070 d4a4d8b — bumping the manifests first and the README pins after | the readme suite pins them to package.json, so the intermediate commit is one where CI is red and the documented install is wrong
• r-rel070 d4a4d8b — rebuilding dist for the version change | the version is read at runtime, and a rebuild would move the digest every M5 row records without changing a byte of behaviour
• r-numgate b770054 — repointing README_SOURCES at M5 inside the release | its own comment explains why the declaration is deliberate, and writing that note in a hurry would produce exactly the careless publication it was built to stop
• r-numgate b770054 — dropping the rates too and linking everything | the two rates are the claim, and a README that states a behaviour result without its magnitude sends every reader to a second document to learn what was measured
• r-readmem5 6d04c0b — putting the limits in docs/evidence.md and linking them | a reader who stops at the table has then read a claim without its scope, and the scope is what makes the claim survivable
• r-readmem5 6d04c0b — rounding 6.7x into the headline | the ratio is arithmetic on two small counts and moves fast with either; the two rates and the interval are what the study actually bounds
• r-clog070 172fa3d — grouping by conventional-commit type | the reason a reader opens this file is "what breaks and what is now possible", and feat:/fix: sorts by the author's vocabulary rather than by that question
• r-readmecold 08efdff — cutting the evidence sections down to move them up | the caveats are the reason the numbers can be trusted, and a shorter honest section is a longer dishonest one
• r-readmecold 08efdff — reordering all four languages in this change | it would mean moving text I cannot re-read for accuracy, and a mistranslated claim is worse than a badly ordered one
• r-selfaudit cd0068f — generating the page from the issue tracker | the value is in the one-line account of what each defect cost, which no title carries, and a generated list of titles reads as a changelog
• r-selfaudit cd0068f — leading with the shipped-bug section | those flatter, because everyone ships bugs; the false-claims section is the one almost no project publishes and the only one that is evidence about this project rather than about software
• r-cdebver01 ce7b278 — default-in discovery over the CDEB tree like the legacy gate | that gate's enemy was the unregistered file, CDEB's is the unregistered input, and bench:m5 reads every jsonl in bench/results, so the registered analysis would run over M1, M4 and files marked non-citable #441 showed a glob passing a stopping rule on contamination
• r-cdebver01 ce7b278 — validating with the draft-07 Ajv entry and downgrading the schemas | the 2020-12 entry ships in the same package, and weakening six schemas to fit a meta-schema is backwards
• r-claimsmatch 506ada4 — Softening the delivery paragraph instead | it is the accurate one, and the scene was the sentence out of step with it
• r-claimsmatch 506ada4 — Deleting the pricing scene | it is the clearest illustration in the README of what a record contains, and the defect was its last sentence rather than the scene
• r-m5analysis 3450656 — Computing the table now and not looking | the file would exist, and a number that exists is a number someone reads

Truncated: 267 lines omitted — the comment hit GitHub's 65000 character limit.

_{Trailer violations fail this check. Active constraints are informational — they are what the repository already decided, not a verdict on this PR.}