@avi2dg/checks 0.52.0 → 0.53.0

package/CHANGELOG.md

@@ -2,576 +2,15 @@
 
 Every release of `@avi2dg/checks`, newest first, written by the release from its conventional commits.
 
-## 0.52.0
+## 0.53.0
 
-Released 2026-10-25.
+Released 2026-10-26.
 
 ### Features
 
-- **docs:** short front door README and refuse hand copied pinned versions [#206](https://github.com/avi2d/checks/pull/206)
-- **testing:** add 28-day refresh window for restored mutation baselines [#205](https://github.com/avi2d/checks/pull/205)
+- **delivery:** release each push to main as a versioned npm release [#5](https://github.com/avi2d/checks/pull/5)
+- **delivery:** keep private terms out of commits and pull request text [#2](https://github.com/avi2d/checks/pull/2)
 
 ### Fixes
 
-- **delivery:** refuse fork-reachable self-hosted runners, read fleet pins from config [#204](https://github.com/avi2d/checks/pull/204)
-- upgrade fast-uri and zod past the October advisories [#202](https://github.com/avi2d/checks/pull/202)
-
-## 0.51.0
-
-Released 2026-10-23.
-
-### Features
-
-- **testing:** reuse full baseline results for unchanged files [#197](https://github.com/avi2d/checks/pull/197)
-
-### Fixes
-
-- **delivery:** accept GitHub display name on commits GitHub made [#198](https://github.com/avi2d/checks/pull/198)
-- **testing:** correct unit test fallback order wording to Bun default directory order [#195](https://github.com/avi2d/checks/pull/195)
-
-## 0.50.1
-
-Released 2026-10-20.
-
-### Fixes
-
-- **delivery:** admit the self-hosted iphone runner in private-repo ci-wiring [#193](https://github.com/avi2d/checks/pull/193)
-
-## 0.50.0
-
-Released 2026-10-20.
-
-### Features
-
-- **testing:** cap local checks-test at the unit tier plus a declared smoke list [#191](https://github.com/avi2d/checks/pull/191)
-
-## 0.49.0
-
-Released 2026-10-20.
-
-### Features
-
-- **testing:** build the full mutation baseline with bail, fastest unit tests first [#190](https://github.com/avi2d/checks/pull/190)
-
-### Fixes
-
-- **delivery:** name the parsed invocation's line in CI wiring refusals [#189](https://github.com/avi2d/checks/pull/189)
-- **quality:** refuse named font sizes in font shorthand and build token map once per file [#188](https://github.com/avi2d/checks/pull/188)
-- **delivery:** judge shell-shaped release references in checks-ci-wiring [#186](https://github.com/avi2d/checks/pull/186)
-
-## 0.48.1
-
-Released 2026-10-20.
-
-### Fixes
-
-- **quality:** hold font shorthand and local size custom properties to the tokens option [#185](https://github.com/avi2d/checks/pull/185)
-- **testing:** compare checks-night-run against the latest night that recorded scores [#184](https://github.com/avi2d/checks/pull/184)
-- **testing:** default checks-test --parallel to the machine's core count [#182](https://github.com/avi2d/checks/pull/182)
-
-## 0.48.0
-
-Released 2026-10-19.
-
-### Features
-
-- **quality:** add opt-in BEM, flat selector and page :has stylelint options [#179](https://github.com/avi2d/checks/pull/179)
-
-## 0.47.0
-
-Released 2026-10-19.
-
-### Features
-
-- **testing:** file night-run regressions as GitHub issues instead of gating pull requests [#174](https://github.com/avi2d/checks/pull/174)
-
-## 0.46.0
-
-Released 2026-10-19.
-
-### Features
-
-- **quality:** refuse CSS comments, non-ASCII selectors and stylesheets over 400 lines [#172](https://github.com/avi2d/checks/pull/172)
-
-## 0.45.1
-
-Released 2026-10-19.
-
-### Fixes
-
-- **quality:** pass @property in the Baseline CSS gate at every target [#169](https://github.com/avi2d/checks/pull/169)
-
-## 0.45.0
-
-Released 2026-10-18.
-
-### Breaking changes
-
-- **quality:** hold CSS to the stylelint rule families set in stylelint.config.ts [#167](https://github.com/avi2d/checks/pull/167)
-
-## 0.44.0
-
-Released 2026-10-18.
-
-### Features
-
-- split the test suite into parallel unit and e2e CI tiers [#162](https://github.com/avi2d/checks/pull/162)
-- **testing:** hunt flakes with parallel test workers and replay failing workers [#164](https://github.com/avi2d/checks/pull/164)
-- **mutation:** add checks-mutation-scope to limit PR mutation runs to the change [#161](https://github.com/avi2d/checks/pull/161)
-- **quality:** add checks-no-plain-js gate refusing plain JavaScript sources [#163](https://github.com/avi2d/checks/pull/163)
-- **docs:** add checks-copy gate to refuse dashes in declared copy [#160](https://github.com/avi2d/checks/pull/160)
-
-## 0.43.0
-
-Released 2026-10-17.
-
-### Features
-
-- **testing:** run checks-test files in parallel on opt-in [#158](https://github.com/avi2d/checks/pull/158)
-
-## 0.42.0
-
-Released 2026-10-14.
-
-### Features
-
-- **delivery:** fail a setup-bun step whose Bun version drifts from the fleet pin [#156](https://github.com/avi2d/checks/pull/156)
-
-## 0.41.1
-
-Released 2026-10-14.
-
-### Fixes
-
-- **delivery:** refuse workflow references to missing workflows or jobs in ci-wiring [#153](https://github.com/avi2d/checks/pull/153)
-
-## 0.41.0
-
-Released 2026-10-12.
-
-### Features
-
-- **testing:** keep mutation baselines and flake reports out of Actions artifact storage [#150](https://github.com/avi2d/checks/pull/150)
-
-## 0.40.0
-
-Released 2026-10-11.
-
-### Features
-
-- **delivery:** fold title lint into the ci job and trim docs-only runs [#146](https://github.com/avi2d/checks/pull/146)
-
-## 0.39.0
-
-Released 2026-10-11.
-
-### Features
-
-- **testing:** prune superseded mutation baselines after main uploads [#144](https://github.com/avi2d/checks/pull/144)
-
-## 0.38.1
-
-Released 2026-10-11.
-
-### Fixes
-
-- **docs:** derive README what-you-see line from source, make Where things are optional [#142](https://github.com/avi2d/checks/pull/142)
-
-## 0.38.0
-
-Released 2026-10-10.
-
-### Features
-
-- **testing:** add checks-mutation-baseline to restore the baseline from a runner cache [#140](https://github.com/avi2d/checks/pull/140)
-
-## 0.37.0
-
-Released 2026-10-09.
-
-### Features
-
-- ship typed defineConfig builders for oxlint, knip and dependency-cruiser [#138](https://github.com/avi2d/checks/pull/138)
-
-## 0.36.0
-
-Released 2026-10-08.
-
-### Features
-
-- **testing:** add unitTestFiles so each mutant loads only the unit tests that cover it [#132](https://github.com/avi2d/checks/pull/132)
-
-## 0.35.1
-
-Released 2026-10-07.
-
-### Fixes
-
-- **delivery:** recognise mutation jobs that run stryker through repository shell scripts [#130](https://github.com/avi2d/checks/pull/130)
-
-## 0.35.0
-
-Released 2026-10-07.
-
-### Features
-
-- **quality:** add the opt-in checks-browser runner and checks-frontend-syntax gate [#127](https://github.com/avi2d/checks/pull/127)
-
-### Fixes
-
-- **testing:** cap mutation concurrency at half the available cores [#129](https://github.com/avi2d/checks/pull/129)
-- **docs:** check Russian prose in the sentence length and one-sentence-per-line rules [#126](https://github.com/avi2d/checks/pull/126)
-
-## 0.34.0
-
-Released 2026-10-03.
-
-### Features
-
-- **delivery:** pin mutation jobs to winbox and default other jobs to hosted runners [#123](https://github.com/avi2d/checks/pull/123)
-
-## 0.33.0
-
-Released 2026-10-03.
-
-### Features
-
-- **docs:** report sentences over trial length caps as advisory [#120](https://github.com/avi2d/checks/pull/120)
-
-### Fixes
-
-- move effect to stable 4.0.0 [#122](https://github.com/avi2d/checks/pull/122)
-- **complexity:** accept signed numbers and earlier props names in thin-astro defaults [#115](https://github.com/avi2d/checks/pull/115)
-- **docs:** judge agent file entries and headings from a CommonMark parse [#116](https://github.com/avi2d/checks/pull/116)
-- **docs:** fail link anchors the checks-docs reference rule could not check [#114](https://github.com/avi2d/checks/pull/114)
-
-## 0.32.0
-
-Released 2026-09-29.
-
-### Features
-
-- **delivery:** add checks-secrets gate that fails a range whose commits add a secret [#112](https://github.com/avi2d/checks/pull/112)
-- **delivery:** open a release pull request daily and tag it when it merges [#111](https://github.com/avi2d/checks/pull/111)
-
-## 0.31.0
-
-Released 2026-09-28.
-
-### Features
-
-- lint .astro files in lint coverage, unused and a thin-frontmatter rule [#108](https://github.com/avi2d/checks/pull/108)
-
-## 0.30.0
-
-Released 2026-09-28.
-
-### Features
-
-- **testing:** refuse full mutation runs outside CI [#106](https://github.com/avi2d/checks/pull/106)
-- **docs:** refuse a decision-record revision link named on one side only [#105](https://github.com/avi2d/checks/pull/105)
-
-## 0.29.0
-
-Released 2026-09-28.
-
-### Breaking changes
-
-- **docs:** hold agent files to a 3,000-character router where every entry points [#101](https://github.com/avi2d/checks/pull/101)
-
-### Fixes
-
-- **testing:** run checks-test with CI=true so focused tests fail locally [#100](https://github.com/avi2d/checks/pull/100)
-
-## 0.28.0
-
-Released 2026-09-28.
-
-### Features
-
-- **dependencies:** add checks-advisories gate for advisories a bun.lock change adds [#98](https://github.com/avi2d/checks/pull/98)
-
-## 0.27.0
-
-Released 2026-09-27.
-
-### Breaking changes
-
-- **quality:** add data-shape oxlint plugin for readonly params and schema twins [#96](https://github.com/avi2d/checks/pull/96)
-- ship stricter type gates for any, optional keys, process.env and ts-reset [#94](https://github.com/avi2d/checks/pull/94)
-
-### Features
-
-- **docs:** check agent files, vanished names and reports about the past [#95](https://github.com/avi2d/checks/pull/95)
-
-### Fixes
-
-- describe the kit without naming its owner in the package description [#91](https://github.com/avi2d/checks/pull/91)
-
-## 0.26.0
-
-Released 2026-09-27.
-
-### Breaking changes
-
-- **complexity:** add checks-exports gate holding unused exports to a shrinking baseline [#89](https://github.com/avi2d/checks/pull/89)
-- move doc templates into dist/templates and presets into src/quality [#88](https://github.com/avi2d/checks/pull/88)
-
-## 0.25.0
-
-Released 2026-09-27.
-
-### Breaking changes
-
-- stop shipping checks-backtest and unused exports keys, guard the tarball with Knip [#86](https://github.com/avi2d/checks/pull/86)
-- sort the kit into src/<vector>/ and require tests/<level>/ [#84](https://github.com/avi2d/checks/pull/84)
-
-### Features
-
-- add checks-unused gate that rejects unreferenced TypeScript files via Knip [#85](https://github.com/avi2d/checks/pull/85)
-
-## 0.24.2
-
-Released 2026-09-27.
-
-### Fixes
-
-- **scripts:** list commits merged in after a bump under that release [#82](https://github.com/avi2d/checks/pull/82)
-- **scripts:** leave versions with no listable commits out of the changelog [#81](https://github.com/avi2d/checks/pull/81)
-
-## 0.24.1
-
-Released 2026-09-27.
-
-### Fixes
-
-- **scripts:** let checks-changelog release a repository that gains its version late [#79](https://github.com/avi2d/checks/pull/79)
-
-## 0.24.0
-
-Released 2026-09-27.
-
-### Features
-
-- **scripts:** ship checks-changelog, checks-release-notes and checks-release-report bins [#77](https://github.com/avi2d/checks/pull/77)
-
-### Fixes
-
-- **scripts:** make checks-vendor re-freeze a cached tree whose owner write bit came back [#76](https://github.com/avi2d/checks/pull/76)
-
-## 0.23.0
-
-Released 2026-09-26.
-
-### Breaking changes
-
-- move cognitive-complexity into its own readability oxlint plugin [#74](https://github.com/avi2d/checks/pull/74)
-
-## 0.22.0
-
-Released 2026-09-26.
-
-### Breaking changes
-
-- replace quality.json with native configs and workflow gates [#72](https://github.com/avi2d/checks/pull/72)
-- declare test skips inline and add live and pixel test tiers [#71](https://github.com/avi2d/checks/pull/71)
-
-### Features
-
-- create GitHub releases with linked changelogs [#70](https://github.com/avi2d/checks/pull/70)
-
-### Fixes
-
-- **scripts:** run generated commitlint through bun so the runner needs no node [#69](https://github.com/avi2d/checks/pull/69)
-- **test:** allow npm pack enough time on release runners [#68](https://github.com/avi2d/checks/pull/68)
-
-## 0.21.0
-
-Released 2026-09-26.
-
-### Features
-
-- **scripts:** let quality.json set the runs-on of generated workflows [#66](https://github.com/avi2d/checks/pull/66)
-
-## 0.20.0
-
-Released 2026-09-26.
-
-### Features
-
-- **scripts:** pin node from .node-version in the generated CI workflow [#64](https://github.com/avi2d/checks/pull/64)
-- **scripts:** add checks-subsumed-tests to report tests another test subsumes in a [#62](https://github.com/avi2d/checks/pull/62)
-
-### Fixes
-
-- **scripts:** lint a PR title that starts with # in the generated commitlint workflow [#63](https://github.com/avi2d/checks/pull/63)
-
-## 0.19.0
-
-Released 2026-09-26.
-
-### Features
-
-- **scripts:** judge checks-mutation-compare mutant by mutant instead of by score [#58](https://github.com/avi2d/checks/pull/58)
-- **scripts:** fail a test left in tests/quarantine past 30 days [#59](https://github.com/avi2d/checks/pull/59)
-- **scripts:** pin shared read-only library clones with checks-vendor [#57](https://github.com/avi2d/checks/pull/57)
-
-## 0.18.0
-
-Released 2026-09-26.
-
-### Features
-
-- **scripts:** generate commitlint and CI workflows with checks-quality [#54](https://github.com/avi2d/checks/pull/54)
-
-### Fixes
-
-- **scripts:** make checks-quality refuse a config that drops the kit's extends [#55](https://github.com/avi2d/checks/pull/55)
-
-## 0.17.0
-
-Released 2026-09-25.
-
-### Features
-
-- **effect-channel:** add a cognitive complexity rule and make it the size budget's [#50](https://github.com/avi2d/checks/pull/50)
-- **scripts:** export the refused directive names from comment-matchers [#49](https://github.com/avi2d/checks/pull/49)
-- refuse undeclared package imports and deprecated symbol use [#48](https://github.com/avi2d/checks/pull/48)
-
-## 0.16.0
-
-Released 2026-09-25.
-
-### Features
-
-- **scripts:** add checks-repetition to hold new repetition in production code [#46](https://github.com/avi2d/checks/pull/46)
-- **scripts:** add the recommended size limits, a tests budget and an overrun ratchet [#45](https://github.com/avi2d/checks/pull/45)
-
-## 0.15.0
-
-Released 2026-09-25.
-
-### Features
-
-- **scripts:** hold living docs to prose rules and resolvable references in checks-docs [#42](https://github.com/avi2d/checks/pull/42)
-
-## 0.14.0
-
-Released 2026-09-25.
-
-### Features
-
-- **scripts:** generate README blocks, check CONTRIBUTING.md, and give each bin a page [#39](https://github.com/avi2d/checks/pull/39)
-- **scripts:** generate CHANGELOG.md from conventional commits and ship it in the package [#40](https://github.com/avi2d/checks/pull/40)
-
-## 0.13.0
-
-Released 2026-09-25.
-
-### Features
-
-- **scripts:** add checks-docs gate holding doc files to shared templates [#37](https://github.com/avi2d/checks/pull/37)
-
-## 0.12.0
-
-Released 2026-09-24.
-
-### Features
-
-- **scripts:** add size budget, feature-owner rules and change-signal gates [#35](https://github.com/avi2d/checks/pull/35)
-
-### Fixes
-
-- release 0.12.0 and read local exports in checks-feature-owners [#36](https://github.com/avi2d/checks/pull/36)
-
-## 0.11.0
-
-Released 2026-09-24.
-
-### Features
-
-- **scripts:** add quality.json with schema, loader and checks-quality fragment generator [#33](https://github.com/avi2d/checks/pull/33)
-
-## 0.10.0
-
-Released 2026-09-24.
-
-### Features
-
-- **scripts:** add checks-test skip gate and checks-flake seed recorder [#31](https://github.com/avi2d/checks/pull/31)
-
-## 0.9.0
-
-Released 2026-09-24.
-
-### Features
-
-- **scripts:** let ciWiring.lintGates select the gates checks-lint runs [#29](https://github.com/avi2d/checks/pull/29)
-- **oxlintrc:** turn on no-unsafe-type-assertion and no-non-null-assertion [#26](https://github.com/avi2d/checks/pull/26)
-
-### Fixes
-
-- **scripts:** split Effect-free comment matchers out for hosts without node_modules [#30](https://github.com/avi2d/checks/pull/30)
-- **scripts:** judge a repository's first commit against the empty tree in the range gates [#28](https://github.com/avi2d/checks/pull/28)
-- **lint:** cruise the whole repo; lint-coverage counts skips and exits 2 on a failed walk [#27](https://github.com/avi2d/checks/pull/27)
-
-## 0.8.0
-
-Released 2026-09-24.
-
-### Features
-
-- **scripts:** add checks-lint to run every kit lint gate over one resolved range [#25](https://github.com/avi2d/checks/pull/25)
-- **scripts:** run the bins on Effect and hold scripts/ to Effect-native IO [#22](https://github.com/avi2d/checks/pull/22)
-
-## 0.6.0
-
-Released 2026-09-24.
-
-### Features
-
-- add checks-suppressions-ratchet to refuse a raised oxlint suppression count [#21](https://github.com/avi2d/checks/pull/21)
-
-## 0.5.0
-
-Released 2026-09-24.
-
-### Features
-
-- **effect-channel:** add opt-in no-throw and no-try-catch rules [#20](https://github.com/avi2d/checks/pull/20)
-
-## 0.4.0
-
-Released 2026-09-24.
-
-### Features
-
-- add checks-ci-wiring to confirm CI runs each declared gate on pull requests [#19](https://github.com/avi2d/checks/pull/19)
-
-### Fixes
-
-- pin the quarantine pathIgnorePatterns in the test-layout bunfig check [#18](https://github.com/avi2d/checks/pull/18)
-
-## 0.3.0
-
-Released 2026-09-23.
-
-### Features
-
-- add checks-mutation-compare no-regression gate for Stryker reports [#17](https://github.com/avi2d/checks/pull/17)
-- ship a shared Stryker mutation-testing preset [#16](https://github.com/avi2d/checks/pull/16)
-
-## 0.2.0
-
-Released 2026-09-23.
-
-### Features
-
-- expose runnable scripts as checks- bins for consumer package scripts [#15](https://github.com/avi2d/checks/pull/15)
-- rename npm package from @avi2d/checks to @avi2dg/checks [#14](https://github.com/avi2d/checks/pull/14)
-- add a shared comment gate and backtest command [#12](https://github.com/avi2d/checks/pull/12)
-- publish @avi2d/checks to the public npm registry [#11](https://github.com/avi2d/checks/pull/11)
-
-### Fixes
-
-- count violation lines from file top, drop dead moduleStart [#10](https://github.com/avi2d/checks/pull/10)
+- **delivery:** skip pr-text scan when CHECKS_SECRETS_PACK is unset [#6](https://github.com/avi2d/checks/pull/6)

package/docs/bins.md

@@ -52,11 +52,15 @@ These bins run on their own:
 - [`checks-release-notes`](gates/checks-release-notes.md) writes one `CHANGELOG.md` section to a file for a GitHub release.
 - [`checks-release-report`](gates/checks-release-report.md) tells whether the history holds unreleased features or fixes since the last tag.
 - [`checks-release-pr`](gates/checks-release-pr.md) opens or refreshes the pull request that releases the next version, and dispatches its checks.
+- [`checks-release-publish`](gates/checks-release-publish.md) publishes the version `package.json` holds to npm, unless npm already holds it or a newer version.
+- [`checks-release-push`](gates/checks-release-push.md) releases a package's next version onto its branch once the checks pass, tags it and dispatches the release workflow on the tag.
 - [`checks-release-tag`](gates/checks-release-tag.md) tags a landed release commit with its version and dispatches the release workflow on the tag.
 - [`checks-vendor`](gates/checks-vendor.md) pins each library its `prepare` arguments name to a shared read-only clone and links it under `repos/`.
 - [`checks-browser`](gates/checks-browser.md) opens a product's built pages in Chrome and fails on the layout, keyboard, motion, accessibility, nesting and asset checks its `browser-checks.json` declares.
 - [`checks-commit-title`](gates/checks-commit-title.md) lints the pull request title in one step of the `ci` job.
+- [`checks-pr-text`](gates/checks-pr-text.md) scans the title, body and comments of a pull request in a public repository for a secret or a term of the private pack.
 - [`checks-docs-only`](gates/checks-docs-only.md) tells whether a change touches only top-level Markdown and Markdown under `docs/`, so a docs-only change skips the full run.
+- [`checks-setup`](gates/checks-setup.md) writes the kit config, the CI workflow and the doc templates into a new repository.
 
 `checks-lint` has [its own page](gates/checks-lint.md), which says which range it resolves.
 oxlint runs through its own tool, as [Native settings](configs/native-settings.md) says.

package/docs/configs/commit-messages.md

@@ -22,15 +22,16 @@ The title lint runs before the docs-only filter, so a change to top-level Markdo
 
 ## What it lints
 
-It lints the pull request title and nothing else.
-The title is the enforced subject because a squash merge uses it as the main commit subject, and per-commit messages are not linted.
+It lints the pull request title, or the head subject when no open pull request heads the dispatched branch.
+The title is the enforced subject because a squash merge uses it as the main commit subject, and otherwise per-commit messages are not linted.
 GitHub appends the pull request number to the squashed subject, so the bin lints the title with ` (#0000)` attached.
 The header length limit applies to the landed subject, not the bare title.
 The bin moves the git comment character off `#`, so a title starting with `#` is linted like any other.
-The `ci` job also triggers on `workflow_dispatch`, as [checks-release-pr](../gates/checks-release-pr.md) says.
+The `ci` job also triggers on `workflow_dispatch`, as [checks-release-pr](../gates/checks-release-pr.md) and [checks-release-push](../gates/checks-release-push.md) say.
 GitHub holds the `pull_request` runs of a release pull request the workflow token opens until a maintainer approves them.
 A dispatched run carries no pull request, so the bin reads the title of the one open pull request its branch heads.
-It fails when there is none.
+When no open pull request heads the branch, the head commit lands as it is, so the bin lints its subject as it stands.
+It fails when more than one does.
 That lookup needs the workflow's `pull-requests: read` permission.
 The `commitlint` status covers a dispatched run too, since GitHub keeps a dispatched run's check off the pull request.
 The kit's own `.github/workflows/ci.yml` shows the step.

package/docs/design.md

@@ -186,24 +186,34 @@ So a checkout without tags, a fork, and a branch that merged `main` in all write
 A section keeps the date it was written, because the squash merge that lands the release commit may fall on another day.
 Entries come from commit subjects, which are the squash-merged pull request titles that commitlint holds to the conventional format.
 A commit body holds the branch's own messages, and nothing lints it, so no entry comes from a body.
-The changelog arrives in the release pull request, and no workflow pushes to a branch a person works on.
+The changelog arrives in the release commit, and no workflow pushes to a branch a person works on.
 
-## A release is cut every day
+## A release is cut from every push
 
 A release waits for no quiet moment, since a busy repository always has work under way.
-The daily release opens the release pull request from `main` whenever it holds a feature or a fix since the last tag, and the pull request merges through the repository's usual merge path once its checks pass.
+A package published to npm releases from every push to `main` that holds a feature or a fix since the last tag.
+A version only reaches its users once it is published.
+A daily release pull request would leave each merged change unpublished until a person merged the release too.
+`checks-release-push` builds the release commit on top of `main` and runs the required checks on it from the `release/<branch>` branch it owns.
+Only then does it move `main` to it without a force, so `main` only ever gains a release commit whose checks passed.
+It tags the commit it landed and nothing else.
+A repository that is no package keeps the daily release pull request.
 `checks-release-pr` writes only to the `release/<branch>` branch it owns, and rebuilds that branch on `main` rather than merging `main` into it, so the changelog it carries is the one the build writes.
 `checks-release-tag` writes only the `v*` tag of a release commit that already landed.
 The `github-release` job's `contents: write` creates or updates the GitHub release from the tag's `CHANGELOG.md` section.
 
-Both jobs act with the workflow token.
+Every release bin acts with the workflow token.
 GitHub starts no run for a push that token makes, and holds the runs of a pull request it opens until a maintainer approves them.
 A GitHub App or a personal token would start them, but either is a credential each repository stores and someone rotates.
-So `checks-release-pr` dispatches the required checks on the release head, and `checks-release-tag` dispatches the release workflow on the tag, since a dispatch is the one run the token can start.
+A dispatch is the one run the token can start.
+So `checks-release-pr` and `checks-release-push` dispatch the required checks on the release head.
+`checks-release-tag` and `checks-release-push` dispatch the release workflow on the tag.
 GitHub keeps a dispatched run's checks off the pull request, and branch protection does not count them.
 So each dispatched job reports its result as a commit status named for the job, which a required check of that name counts.
 Where a status and a check share a name, branch protection requires both, so the status never passes a pull request whose own check failed.
-The cost is a `workflow_dispatch` trigger and a status step on each workflow a release needs, a title lint that reads its title from the open pull request, and the repository setting that lets the token open a pull request.
+The cost is a `workflow_dispatch` trigger and a status step on each workflow a release needs.
+The title lint reads its title from the open pull request, or lints the head subject when none is open.
+The daily release also needs the repository setting that lets the token open a pull request.
 
 ## The docs gate judges what a change touches
 
@@ -300,6 +310,18 @@ No finding can be accepted.
 A secret has no false positive worth keeping in git, because a placeholder carries the same shape without the value.
 So the gate ignores a repository's `.gitleaks.toml`, `.gitleaksignore` and `gitleaks:allow` comments, which would each let one repository pass what another fails.
 
+A person's name, an employer's domain, host names and IP ranges are no secret to gitleaks, yet a public repository must not carry them.
+A rule that names them would publish them, so the owner keeps the terms in a private pack outside every repository.
+The pack is a file rather than an inline variable, so one file serves the shell and the runner, and no workflow names a term.
+A pack that is set but cannot serve fails the gate, because a scan that quietly dropped it would pass what it exists to catch.
+An empty `CHECKS_SECRETS_PACK` counts as set, since a CI secret that is missing expands to an empty value.
+No report prints a matched term text or the pack path, because the report lands in a public CI log.
+A finding location prints as it stands, such as a file name or a link.
+So a term inside a file name or a repository name shows there.
+That location is already public in the scanned commit or the scanned pull request.
+
+A pull request's title, body and comments reach the forge without a commit, so [checks-pr-text](gates/checks-pr-text.md) scans them with the same rules and the same pack.
+
 ## The frontend checks are opt-in
 
 A browser check needs a built site and a browser, and a backend repository has neither.