Changelog

v3.261.2 — 2026-09-04

• feat(git-data): pre-birth hardening — own ingest source, non-root metadata drop, warning-stage routing

v3.261.1 — 2026-09-04

• feat(inngest): the gated inngest-volume-recut target, and the boot-reopen unit that would never have run

v3.261.0 — 2026-09-04

Web Platform

• deploy-docs.yml no longer publishes to GitHub Pages: the three actions/*-pages* steps, the environment: block, and the pages: / id-token: write permissions are gone; permissions is now {contents: read}.
• The removed environment: carried a measured {"name":"main","type":"branch"} deployment-branch policy. That was not dropped silently — it is replaced by an explicit github.ref == 'refs/heads/main' condition on the deploy job.
• Probe B is now the load-bearing post-deploy assertion (the apex serves the current build), with the verdict step's GitHub-Pages arm removed.
• New guard apps/web-platform/infra/pr5-anchor-integrity.test.sh pins the runbook's cited anchors at heading position with an exactly-one count, plus act ordering and the AC33 literal absence. 14/14, and 11/11 mutants caught with a green control.

Knowledge base

• model.c4: two anticipatory phrasings flipped to completed tense (AC55). The from #7640/ADR-194 provenance citation at :250 is deliberately preserved. model.likec4.json regenerated (69 elements / 141 relations / 71 views).
• Runbook, ADR-194 amendment, and model.c4 all state the rollback narrowing.
• Plan and both spec dirs archived (AC58).

Plugin

• plugins/soleur/test/lib/git-clean-env.ts — a shared GIT_*-stripping helper, adopted by three suites. See "A note on the test fixtures" below.

v3.260.6 — 2026-09-04

• docs(legal): PA-7 asserted "None." over an unfiltered free-text field — amend §(c), Art. 9, and the lawful-basis limb

v3.260.5 — 2026-09-04

• feat(test-fixtures): add the P1b relative-operand rule (1225 sites, all families grandfathered)

v3.260.4 — 2026-09-04

Legal

• Add the Art. 33(5) breach register: 4 indexed determinations, 6 reasoned waivers, controller capacity, status: draft-requires-counsel-review.
• Art. 30 register: re-ground PA-8 §(d), separate the §(e) safeguard limb, resolve §(f) placeholders to NOT RECORDED with dated markers, add two §(g) entries, correct PA-31 §(g), and mark the Vendor Mapping DPA NOT EXECUTED.
• Close the pointer chain in all three legs — the canonical determination record, the Art. 30 register's §Register Maintenance, and the statutory response catalog's accountability pack.
• Fix a rendering defect in a signed counsel review: an unescaped | inside a code span pushed a row past its header, so its CONFIRMED verdict cell had never rendered. One character; changes no claim.

Engineering

• scripts/lint-legal-registers.sh + a 36-assertion suite; registered on the required test context and in REQUIRED_RUNNERS (floor 5 → 6).

• scripts/check-pa-22.sh: anchor on the heading separator (a rename to 22-RENAMED previously still counted as present), and scope assertions to the Vendor Mapping section and the PA-22 block. First test suite for a script that ran in zero runners — 13 assertions.

• scripts/tenant-dpa-register-guard.sh: parameterise --section / --anchor-column / --placeholder; exact section matching instead of a regex.

• /soleur:incident now routes an art_33_triggered: true PIR to the breach register.

• plugins/soleur/test/web-platform-runtime-plugin-trigger.test.ts: stop the fixture builder committing into the developer's repo. Its runGate() passes cwd: <tempdir> to every git call but inherited process.env, and git exports GIT_DIR into hook processes — GIT_DIR overrides cwd. Under lefthook's plugin-component-test job it appended 16 base/change commits to this branch and a git push published them. Fixed with the gitCleanEnv() idiom this repo already uses in welcome-hook.test.ts and lint-orphan-test-suites.test.sh. Proven both ways against a throwaway victim repo: pre-fix leaks exactly 16, post-fix leaks 0 with the suite 14/14.

Docs

• ADR-200; the session learning; one bullet in ship/references/register-update-pr-pattern.md on the four ways an evidentiary record loses content while every grep stays green.

v3.260.3 — 2026-09-04

Ship gate

• The hypothetical strip is paragraph-scoped: the label opens a window closed by a blank line, a heading, or a new list item, and re-opened by an actuality idiom ("already happened").
• The line filter is merged into the same awk. As two stages it was incoherent — the filter ran after the paragraph strip and deleted lines the re-admit had restored, so "The outage already happened … and it would break production again" read as NO SIGNAL. Measured across 1903 inputs (25 fixtures + 1878 plans): zero verdict movers, so the merge is behaviour-preserving on the whole corpus and moves only the constructed case.
• The rewriting stages substitute a SPACE instead of deleting. They previously fused neighbours into forged tokens — pro + `x` + duction signalled on a document containing no unbroken production.
• An unbalanced fence no longer swallows the document tail. An odd ``` count in a pasted PR body deleted the entire linked plan, at exit 1, with no note. Balanced fences still hide their contents.
• The accepted residual is observable: a PIR-STRIP-SUPPRESSED note on stderr. It has no programmatic consumer — Phase 5.5 branches on the exit code alone — so it is a signal to the reader of the transcript, not a gate.
• A gate-fixing PR gets a legal exit via three conjuncts, two of them mechanical. Conjunct 2 (every changed path is gate-subject or a pipeline artifact) independently REJECTS d31d8a2c7 — a real production delivery outage whose fix also edited this gate — without consulting any declaration.

Corpus impact

Measured against main, sweeping find knowledge-base/project/plans -name '*.md' (recursive, 1878 files including archive/): 315 → 304 signal, 11 movers, 0 no → yes. Every mover was individually adjudicated: each dropped line sits inside a trigger-opened paragraph and none asserts actuality ("would go unpaged", "goes unsurfaced because", "one container restart away from a hard outage").

The glob matters. Task 2.6 prescribes plans/*.md (top-level, 1548 files), which reads 268 → 260 with 8 movers. Both are correct over their own corpus; a verifier following AC6c's glob will find 8, not 11.

web-v0.260.1 — 2026-09-04

• feat(inngest): the gated inngest-volume-recut target, and the boot-reopen unit that would never have run

web-v0.260.0 — 2026-09-04

Web Platform

• deploy-docs.yml no longer publishes to GitHub Pages: the three actions/*-pages* steps, the environment: block, and the pages: / id-token: write permissions are gone; permissions is now {contents: read}.
• The removed environment: carried a measured {"name":"main","type":"branch"} deployment-branch policy. That was not dropped silently — it is replaced by an explicit github.ref == 'refs/heads/main' condition on the deploy job.
• Probe B is now the load-bearing post-deploy assertion (the apex serves the current build), with the verdict step's GitHub-Pages arm removed.
• New guard apps/web-platform/infra/pr5-anchor-integrity.test.sh pins the runbook's cited anchors at heading position with an exactly-one count, plus act ordering and the AC33 literal absence. 14/14, and 11/11 mutants caught with a green control.

Knowledge base

• model.c4: two anticipatory phrasings flipped to completed tense (AC55). The from #7640/ADR-194 provenance citation at :250 is deliberately preserved. model.likec4.json regenerated (69 elements / 141 relations / 71 views).
• Runbook, ADR-194 amendment, and model.c4 all state the rollback narrowing.
• Plan and both spec dirs archived (AC58).

Plugin

• plugins/soleur/test/lib/git-clean-env.ts — a shared GIT_*-stripping helper, adopted by three suites. See "A note on the test fixtures" below.

web-v0.259.7 — 2026-09-04

• docs(legal): PA-7 asserted "None." over an unfiltered free-text field — amend §(c), Art. 9, and the lawful-basis limb

web-v0.259.6 — 2026-09-04

• feat(test-fixtures): add the P1b relative-operand rule (1225 sites, all families grandfathered)

web-v0.259.5 — 2026-09-04

Legal

• Add the Art. 33(5) breach register: 4 indexed determinations, 6 reasoned waivers, controller capacity, status: draft-requires-counsel-review.
• Art. 30 register: re-ground PA-8 §(d), separate the §(e) safeguard limb, resolve §(f) placeholders to NOT RECORDED with dated markers, add two §(g) entries, correct PA-31 §(g), and mark the Vendor Mapping DPA NOT EXECUTED.
• Close the pointer chain in all three legs — the canonical determination record, the Art. 30 register's §Register Maintenance, and the statutory response catalog's accountability pack.
• Fix a rendering defect in a signed counsel review: an unescaped | inside a code span pushed a row past its header, so its CONFIRMED verdict cell had never rendered. One character; changes no claim.

Engineering

• scripts/lint-legal-registers.sh + a 36-assertion suite; registered on the required test context and in REQUIRED_RUNNERS (floor 5 → 6).

• scripts/check-pa-22.sh: anchor on the heading separator (a rename to 22-RENAMED previously still counted as present), and scope assertions to the Vendor Mapping section and the PA-22 block. First test suite for a script that ran in zero runners — 13 assertions.

• scripts/tenant-dpa-register-guard.sh: parameterise --section / --anchor-column / --placeholder; exact section matching instead of a regex.

• /soleur:incident now routes an art_33_triggered: true PIR to the breach register.

• plugins/soleur/test/web-platform-runtime-plugin-trigger.test.ts: stop the fixture builder committing into the developer's repo. Its runGate() passes cwd: <tempdir> to every git call but inherited process.env, and git exports GIT_DIR into hook processes — GIT_DIR overrides cwd. Under lefthook's plugin-component-test job it appended 16 base/change commits to this branch and a git push published them. Fixed with the gitCleanEnv() idiom this repo already uses in welcome-hook.test.ts and lint-orphan-test-suites.test.sh. Proven both ways against a throwaway victim repo: pre-fix leaks exactly 16, post-fix leaks 0 with the suite 14/14.

Docs

• ADR-200; the session learning; one bullet in ship/references/register-update-pr-pattern.md on the four ways an evidentiary record loses content while every grep stays green.

web-v0.259.4 — 2026-09-04

Ship gate

• The hypothetical strip is paragraph-scoped: the label opens a window closed by a blank line, a heading, or a new list item, and re-opened by an actuality idiom ("already happened").
• The line filter is merged into the same awk. As two stages it was incoherent — the filter ran after the paragraph strip and deleted lines the re-admit had restored, so "The outage already happened … and it would break production again" read as NO SIGNAL. Measured across 1903 inputs (25 fixtures + 1878 plans): zero verdict movers, so the merge is behaviour-preserving on the whole corpus and moves only the constructed case.
• The rewriting stages substitute a SPACE instead of deleting. They previously fused neighbours into forged tokens — pro + `x` + duction signalled on a document containing no unbroken production.
• An unbalanced fence no longer swallows the document tail. An odd ``` count in a pasted PR body deleted the entire linked plan, at exit 1, with no note. Balanced fences still hide their contents.
• The accepted residual is observable: a PIR-STRIP-SUPPRESSED note on stderr. It has no programmatic consumer — Phase 5.5 branches on the exit code alone — so it is a signal to the reader of the transcript, not a gate.
• A gate-fixing PR gets a legal exit via three conjuncts, two of them mechanical. Conjunct 2 (every changed path is gate-subject or a pipeline artifact) independently REJECTS d31d8a2c7 — a real production delivery outage whose fix also edited this gate — without consulting any declaration.

Corpus impact

Measured against main, sweeping find knowledge-base/project/plans -name '*.md' (recursive, 1878 files including archive/): 315 → 304 signal, 11 movers, 0 no → yes. Every mover was individually adjudicated: each dropped line sits inside a trigger-opened paragraph and none asserts actuality ("would go unpaged", "goes unsurfaced because", "one container restart away from a hard outage").

The glob matters. Task 2.6 prescribes plans/*.md (top-level, 1548 files), which reads 268 → 260 with 8 movers. Both are correct over their own corpus; a verifier following AC6c's glob will find 8, not 11.

v3.260.2 — 2026-09-03

• fix(tooling): hook suites no longer write the real incident ledger; the merge poll outlasts CI

v3.260.1 — 2026-09-03

• docs(model-policy): the Fable 5.1 re-tier audit, and a third ADR-083 gate

v3.260.0 — 2026-09-03

• feat(infra): PR4b — flip the apex to a CNAME at the one address core can order

v3.259.3 — 2026-09-03

• infra(git-data): bake the Better Stack ingest token at 0600, and close the argv hole the first draft reopened

v3.259.2 — 2026-09-03

• fix(test-fixtures): burn the P1a fixture-dir operand baseline from 167 sites to 9 acknowledged

v3.259.1 — 2026-09-03

• fix(hooks): stop a superseded Monitor from being layered instead of replaced

v3.259.0 — 2026-09-03

• fix(inngest-cutover): a Doppler secret name was arbitrary command execution as root

v3.258.5 — 2026-09-03

• fix(release): the build type-checks a file that imports a pruned module

v3.258.4 — 2026-09-03

• feat(infra): PR4a — shrink the apex to one address so core can order the flip

v3.258.3 — 2026-09-03

• fix(model-launch): Fable 5.1 would have made the drift cron permanently red

v3.258.2 — 2026-09-03

• fix(infra): guard the ssl=full rule holding the apex up, and fix a removal condition that could never be met

v3.258.1 — 2026-09-03

#7570 — D1 can attribute its own failure. D1's predicate read an unset $CAPTURE under set -u, reachable only in the failing direction, so a real defect aborted unattributed. Replaced with a shared _d1_holds() helper, plus D1-MUT (3 rungs: the mutation landed via cmp, the mutant exits 2, the verdict rejects under set -u; unset CAPTURE) and a structural assertion binding the live call site to the helper — because the mutation arm alone drove only the helper.

#7534 — the evidence hash can no longer be blind. git-data-birth-readiness-gate.sh now asserts the module's canonical payload shape across every *.tf / *.tf.json in the module directory, not just main.tf — a file("${path.root}/../../evil.sh") in outputs.tf renders into user_data and editing that payload does not move the digest (measured). The binding-form family widened from file(base64|sha256|sha512|md5)?\( to file[a-z0-9]*\(; filesha1, filebase64sha256, fileset and fileexists sat outside it on both sides. The check pins the form, not the canonical filename — a filename pin aborts 31 arms of the gate's own suite, and a moved template that keeps the form still hashes correctly.

#7544 — ubuntu base-image drift becomes a named failure. Every docker spin site in the rehearsal suite is pinned to UBUNTU_BASE (ubuntu:24.04@sha256:33ceb719…), with a self-excluding scan asserting all 6 remain pinned, and a new ubuntu:24.04 case in rule-audit.yml's existing staleness step files an idempotent issue on drift. UB_TOK_RC is split from UB_RC and the issue body is branded per-pin via ZOT_IMPLICATED / UBUNTU_IMPLICATED, so an ubuntu drift no longer files a zot-branded issue.

#7481 — the second channel is consulted, and it prints the cause. sentry-issue.sh gains --host-events / --liveness discover modes on the reader that already owns the RO-token ladder. The plan's /projects/<org>/<proj>/events/ endpoint was measured to 403 the RO token and, with the broader token, to ignore the search entirely (100 unfiltered rows, 0 for the host) — /organizations/<org>/events/ with explicit field= projections is used instead. The capture script funnels its six no-verdict paths through transient(), consults the second channel on each, cross-checks on the PASS path, and writes RUNG2_SENTRY_CROSSCHECK into the evidence file. The workflow's redaction tuple went 3 → 11 names, an rc=3 self-probe replaces the eyeball instruction in both the ::error:: and the step summary, and job-log pre-masking moved into its own step.

New suite scripts/sentry-issue-discover.test.sh (23 assertions) asserts the outbound request — all 8 previously-green mutations perturb only that.

Docs corrected in passing: ADR-096 (zot-pin-drift row), ADR-031 (de.sentry.io; append-only addendum), runbooks/sentry-issue-read.md, runbooks/git-data-rung2-rehearsal.md, reusable-release.yml, sentry-audit-gate.yml.

v3.258.0 — 2026-09-03

• feat(docs-deploy): publish to Cloudflare Pages — PR2 of the ADR-194 cutover

web-v0.259.3 — 2026-09-03

• fix(tooling): hook suites no longer write the real incident ledger; the merge poll outlasts CI

web-v0.259.2 — 2026-09-03

• fix(sentry): bump to 0.15.7 — the frequency-trigger fix is in, verified in the tag

web-v0.259.1 — 2026-09-03

• docs(model-policy): the Fable 5.1 re-tier audit, and a third ADR-083 gate

web-v0.259.0 — 2026-09-03

• feat(infra): PR4b — flip the apex to a CNAME at the one address core can order