@cosyte/dicom 0.0.4 → 0.0.6

package/CHANGELOG.md

@@ -4,6 +4,304 @@ All notable changes to `@cosyte/dicom` will be documented in this file. The form
 
 ## [Unreleased]
 
+### Security
+
+- **A defined-length sequence under Implicit VR Little Endian was never opened, so PHI nested inside
+  one survived `deidentify()` into serialized output while the report said it had been removed**
+  (`DICOM-IMPLICIT-SQ-NOT-DESCENDED`, pre-existing and live on the published `0.0.5`). The
+  Implicit VR LE parser delegated to the sequence parser **only** in the undefined-length
+  (`0xFFFFFFFF`) branch, so `Element.items` was `undefined` for every defined-length sequence under
+  that transfer syntax. Nothing that walks items could see inside one, and `deidentify()` recurses
+  into a kept sequence only when its items exist: a `(0010,0010)` Patient's Name in a defined-length
+  item reached `serializeDicom()` output verbatim, with the `DeidentifyReport` naming only the root
+  attribute. **The report therefore asserted a scrub it had not performed**, which is the worse half
+  of the defect: an incomplete audit that reads as a complete one is what a caller trusts before
+  sharing an object. The identical fixture under Explicit VR LE scrubbed clean, because that path
+  already descended both length forms.
+
+  PS3.5 2026c states the obligation twice, about two different length fields, and the one this broke
+  is section **7.5.2** "Delimitation of The Sequence of Items", which governs the `SQ` element's own
+  length: "The encoder of a Sequence of Items may choose either one of the two ways of encoding. Both
+  ways of encoding shall be supported by decoders of the Sequence of Items." Section 7.5.1 "Item
+  Encoding Rules" says the same of each Item's length field. The two choices are independent, so both
+  are now descended in every combination. The de-identified output of the
+  Implicit VR LE fixture and its Explicit VR LE twin are now the same report, attribute for
+  attribute and context path for context path.
+
+  **Three smaller consequences of a sequence now being read**, each the descent working rather than a
+  separate decision: `Element.vm` is the item count instead of the scalar placeholder `1`;
+  `Element.value` yields the real items instead of an empty sequence; and warnings raised **inside**
+  a defined-length sequence, which previously could not exist because its bytes were never parsed,
+  now appear on `ds.warnings` - so under `{ strict: true }` a file whose nested content was always
+  non-conformant now throws. The sequence element itself no longer carries `specificCharacterSet`,
+  matching every other sequence element in the package; items still inherit the enclosing charset.
+
+- **A warning message no longer echoes anything the file said** (`PHI-WARNING-MESSAGE-LEAK`). Three
+  diagnostics reproduced consumer-controlled bytes verbatim, and one of them carried onto the dataset
+  `deidentify()` labels safe to share:
+  - `DICOM_UNSUPPORTED_CHARSET` interpolated the `(0008,0005)` term. That value is **multi-valued on
+    the backslash**, so any component of it, at any position, reached the message whole. It is the
+    measured leak, and `deidentify()` copies `Dataset.warnings` across, so it rode onto the shared
+    artifact.
+  - `DICOM_PRIVATE_CREATOR_UNKNOWN` interpolated the Private Creator string, which is an `LO` a
+    sender authored and which this warning fires on precisely because nothing vouches for it.
+  - The `UNSUPPORTED_TRANSFER_SYNTAX` fatal interpolated the `(0002,0010)` UID into `err.message`,
+    and so into `err.stack` and into whatever an error reporter ships off-box. The writer's
+    equivalent did the same for a `Dataset` a caller built.
+
+  Every message now comes from a **frozen registry** keyed by the warning code. Factories take a
+  position and structural constants only: a tag this parser composed, a VR checked against the closed
+  34-VR set, and input-derived numbers. There is no string parameter to pass a value through, which
+  is the property that distinguishes every `@cosyte/*` parser that does not leak from every one that
+  did. A token failing its check renders `<withheld>` rather than being echoed.
+
+  Where a token has to be named, it comes from a closed set this package controls: the unsupported
+  transfer syntax reads as the dictionary's own label for the UID (`JPEG Baseline (Process 1)`) when
+  PS3.6 publishes one, `DICOM_UNSUPPORTED_CHARSET` names the **1-based value index** of the offending
+  component rather than the component, and the inflate failure reports zlib's error _code_ instead of
+  forwarding zlib's message.
+
+- **Two model fields are bounded, because a diagnostic fix does not protect a downstream package.**
+  `@cosyte/hl7` bounded its messages, went green, and `@cosyte/deid` still leaked off `Segment.type`.
+  The same two shapes here now bound on **membership**, not shape, because DICOM offers no shape to
+  test (`src/parser/tokens.ts` argues why):
+  - `Element.specificCharacterSet` holds only terms PS3.3's closed table names; anything else reads
+    `<withheld>`. Decoding is unchanged: an unmappable term was already skipped.
+  - `Element.privateCreator` holds only creators the active `Profile`'s overlay names. **With no
+    profile, nothing is recognized and the field reads `<withheld>`** - a real reduction in what it
+    tells a caller, and deliberate. The raw creator is still available as the `(gggg,00EE)` element's
+    own `rawBytes`, as a value, where value discipline applies.
+
+  `RetainSafePrivate` is unaffected in either direction: `deidentify()` now re-derives the block
+  reservation from the creator elements of **each Data Set** it walks, so passing a `Profile` at
+  de-identification works whether or not one was passed at parse. **One behaviour does change against
+  0.0.5:** a private data element inside a sequence item whose creator is declared only at the root is
+  now removed rather than retained, because the item has no reservation of its own. That is the
+  conformant reading and the fail-safe direction, but a sender that declares a creator once at the
+  root and writes private data into Per-Frame Functional Groups items will lose those elements under
+  `RetainSafePrivate`. Declare the creator in the Data Set that uses it. Per Data Set is load-bearing, not a
+  detail: PS3.5 §7.5 makes each Sequence Item its own Data Set and §7.8.1 scopes a reservation to the
+  Data Set the creator appears in, so the same block number names different vendors at the root and
+  inside an item. Resolving one against the other retained an item's private element on the root's
+  reservation and wrote its value into the serialized output.
+
+### Fixed
+
+- **A malformed defined-length sequence degrades instead of failing the object, and says so.** Under
+  Implicit VR Little Endian there is no VR on the wire: `SQ` is this parser's inference from PS3.6,
+  not something the sender wrote. So an element whose defined-length value turns out not to be an
+  `(FFFE,E000)` item stream keeps its declared byte range on `Element.rawBytes`, leaves the rest of
+  the object readable, and raises the new Tier-2 `DICOM_SQ_NOT_DESCENDED` warning. The undefined-length
+  form keeps its existing Tier-3 fatal, and that asymmetry is deliberate: a defined length leaves a
+  complete alternative reading of the value, and an undefined one leaves none. **The warning exists
+  because silence is the defect above**: an undescended sequence is invisible to `deidentify()`, so a
+  caller has to be told the audit did not reach inside it. It is not the whole story, though: see the
+  next entry for the shape that stays silent.
+
+- **Only one of the two un-auditable shapes warns, and the docs now say which.** `deidentify()`
+  recurses on `Element.items`, so a sequence the parser could not open is kept verbatim and appears
+  nowhere in the report. The refusal added above raises `DICOM_SQ_NOT_DESCENDED`; an undefined-length
+  `UN` value the CP-246 descent could not read as a sequence raises **nothing** and keeps `vr ===
+"UN"`. That silence is `PRE-EXISTING` and unchanged. The reliable check is `el.items === undefined`
+  on the element, not `ds.warnings`.
+
+- **Residual, pre-existing and now reachable from one more shape.** A refused descent drops its
+  warnings from `ds.warnings`, but an `onWarning` callback has already been handed them: the emit
+  chokepoint delivers to the callback before the rollback can undo the push. The two disagree for
+  exactly those warnings, and `ds.warnings` is the accurate record. Unchanged from the CP-246 path,
+  disclosed rather than fixed (buffering emissions is a larger change than this slice).
+
+- **A test named "explicit-length SQ also descends" proved nothing, and that is how this shipped.**
+  Its two assertions were the VR, which dictionary resolution answers whether or not anything
+  descends, and `vm === 1`, which was the **scalar placeholder** every non-sequence element already
+  carried. Both were green against a parser that never opened the sequence. It now asserts the items.
+
+- **A private block reserved in one Data Set resolved the Implicit VR of a private element in
+  another, so the same bytes decoded as a different value than the file declared**
+  (`DICOM-PARSE-CREATORS-SCOPE`). The parser kept **one** private-creator reservation map for the
+  whole file, so a block number claimed by different vendors at the root and inside a Sequence Item
+  resolved to whichever creator was read **last**, wherever it sat. That map feeds Implicit-VR
+  resolution, which is why this is a wrong decode and not a mislabelling: in a file where an item
+  claims block `0x11` and the root afterwards writes `(0029,1101)` without claiming it, the root
+  element took the **item's** vendor, and with a `Profile` naming that creator's element byte as `SS`
+  the bytes `FF FF` read as **`-1`** rather than as raw bytes. No warning fired. Reservations are now
+  scoped to the Data Set the Private Creator Data Element appears in, at every depth the parser
+  recurses to: an item does not inherit the enclosing Data Set's blocks, an item's own do not reach a
+  sibling item, and none of them survive back out to the enclosing Data Set once the sequence closes.
+
+  PS3.5 2026c section 7.5.1 is the basis: "Each Item Value shall contain a DICOM Data Set composed of
+  Data Elements", closing by delegating to section 7.8 for "rules for incorporating Private Data
+  Elements into Sequence Items", where a Private Creator Data Element "shall be used to reserve a
+  block of Elements with Group Number gggg". Its first Note states the nesting case outright: each
+  item needs to claim the corresponding private block of Elements. Both documents are the vendored,
+  SHA-pinned copies under `vendor/nema/part05/`.
+
+  **Three behaviour changes against `0.0.5`, all confined to files that mix private data with
+  sequences.** (1) A private data element in a Sequence Item whose block is claimed only in an
+  enclosing Data Set now resolves to `UN` plus `DICOM_PRIVATE_TAG_NO_CREATOR`, where it previously
+  took the enclosing claim's VR. The bytes stay on `Element.rawBytes`; what is withheld is a typed
+  decode the file never licensed. Declare the creator in the Data Set that uses it. (2)
+  `Element.privateCreator` is `undefined` on those elements rather than naming a vendor from another
+  Data Set - and that half applies under **every** transfer syntax, including the Explicit VR ones
+  where the VR is on the wire and only the attribution was wrong. (3) **Under `{ strict: true }` the
+  same file now throws**, because `DICOM_PRIVATE_TAG_NO_CREATOR` is a Tier-2 warning and strict
+  promotes Tier-2 warnings to a thrown `DicomParseError`. Nothing about strict changed; the warning
+  is simply now emitted where the standard says the reservation does not reach. The default lenient
+  parse keeps the file and records the warning.
+
+- **An undefined-length `UN` under Implicit VR LE is descended as a sequence instead of failing the
+  whole parse.** `parseImplicitLE` treated any resolved VR other than `SQ` at length `0xFFFFFFFF` as
+  unrecoverable structural corruption, so one private element the reader could not attribute cost the
+  entire object: no patient, no study, no modality, a thrown `INVALID_FILE_META`. It now takes the
+  same CP-246 route the Explicit VR path already took for exactly this shape (`VR=UN` plus undefined
+  length), promoting the element to `SQ` with a `DICOM_UN_PARSED_AS_SQ` warning when the bytes really
+  are items. PS3.5 section 7.5.1 requires decoders to support both item encodings, and losing vendor
+  context is not corruption. Bytes that are genuinely not a sequence still throw exactly as before:
+  the descent restores parser state and drops its warnings on failure. This matters most alongside
+  the scoping fix above, which is what can now turn a profile-resolved `SQ` into a `UN`.
+  `DICOM_UN_PARSED_AS_SQ`'s message now says the element _has_ `VR=UN` rather than _declared_ it,
+  because on this new path nothing was declared: the `UN` is what VR resolution returned.
+
+  This is the read-path half of the defect whose de-identify half shipped above. The harm differs
+  and that is why they are separate: there, an out-of-scope reservation **retained** a private
+  element and wrote it into serialized output; here it hands correct bytes the wrong meaning.
+
+- **`DICOM_UN_PARSED_AS_SQ` printed the literal string `UN` where its message promised a tag.** The
+  descent primitive is handed a byte range rather than a tag, but both call sites hold one, so it is
+  threaded through rather than dropped.
+- **A warning raised inside a Deflated dataset cut its strict-mode snippet from the wrong buffer.**
+  The inner descent forwarded to the outer emission chokepoint, which closes over the **compressed**
+  source, while the forwarded `position.byteOffset` indexes the **inflated** stream. The result was a
+  confidently wrong 16 bytes. The descent now builds its own chokepoint over the inflated buffer; it
+  shares the outer `warnings` array, `onWarning` and `strict`, so warning accumulation, callback
+  ordering and profile posture are unchanged. **One thing does change and it is worth saying plainly:
+  the snippet on that path now carries the real inflated bytes**, where before it carried whatever
+  happened to sit at that offset in the compressed source. It was accidentally uninformative and is
+  now correctly PHI, under the same `snippet`-is-raw-input contract every other path already has.
+- **`DICOM_NONZERO_RESERVED_BYTES` reported the two reserved bytes as one 16-bit number**, which had
+  to pick an endianness the reserved field does not have: it read unambiguously and was wrong under
+  one of the two Explicit VR syntaxes. They are now reported separately, in wire order.
+
+- **`README.md` documented an element-access API that does not exist.** `Dataset.get` / `has` /
+  `getAll` take the 8-character `(group,element)` tag (`"00080060"`, case-insensitive) and nothing
+  else, but the README's quickstart, feature list, access-pattern section, typed-value examples and
+  Philips vendor note all showed `ds.get("Modality")` and `ds.get("(0008,0060)")`. Both forms return
+  `undefined`, and because the `Tag` type is `string` the compiler catches neither: the first line a
+  reader copied out of the quickstart silently produced nothing. Measured against the built package
+  rather than read off the source. The identical defect was found and corrected in
+  `docs-content/intro.md` before `0.0.3` (see below) and the README was not swept with it, which is
+  the reason to state the rule once here: `get` takes a tag, and a keyword is resolved to its tag
+  through `Dictionary.byKeyword(...)?.tag` first. Every example is corrected and the section is
+  retitled from "By keyword or tag" to "By tag". `docs-content/spec-notes-model.md` carried a
+  neighbouring defect and is corrected with it: it said `getAll` "returns every element at a
+  repeating tag", where a `Dataset` holds at most one element per tag, so it returns 0 or 1.
+- **`README.md` claimed compressed transfer syntaxes were readable at the structural level.** It
+  said the supported set was the four v1 syntaxes "and any compressed syntax at the structural level
+  (fragments preserved)". The dispatch table holds exactly four entries and any other Transfer
+  Syntax UID is the fatal `UNSUPPORTED_TRANSFER_SYNTAX`, so a JPEG, JPEG-LS, JPEG2000, RLE or HTJ2K
+  object does not parse at all. Confirmed by parsing a synthetic object in `1.2.840.10008.1.2.4.50`
+  and catching the throw. Deflated Explicit VR LE is the one compressed syntax that is supported: it
+  deflates the dataset stream rather than the pixels, and the corrected text says so rather than
+  calling every compressed syntax unreadable. This mattered most in the "index a folder of studies"
+  recipe, whose closing line promised that "nothing here throws on a quirky file" while a real
+  archive is full of pixel-compressed objects. That recipe now names all four Tier-3 conditions a
+  folder walk meets (`UNSUPPORTED_TRANSFER_SYNTAX`, `INVALID_FILE_META` for a truncated or
+  partly-copied file, `NOT_DICOM_PART_10` for a non-DICOM file in the folder, `EMPTY_INPUT` for a
+  zero-byte one) and says to catch `DicomParseError` per file and skip. The non-goals entry no
+  longer implies a compressed object is read structurally either.
+- **`README.md` counted four typed errors where five are exported.** The Error Handling section
+  introduced "four typed errors" and then documented `DicomParseError`, `DicomValueError`,
+  `DicomSerializeError`, `ProfileDefinitionError` and `DeidentifyError`. The count is now five. The
+  same paragraph said warnings are "never thrown", which a profile's `escalate` list contradicts. It
+  now says warnings are data unless you ask otherwise, and names `escalate` as the route that asks.
+- **`docs-content/` stated the published version as `0.0.1`, two published releases stale.**
+  `installation.md`'s status note and `troubleshooting.md`'s scope entry both named `0.0.1` while
+  npm served `0.0.4`. Neither quotes a version any more. Both send the reader to the registry, which
+  is the only thing that cannot go stale, by naming the command that reads it.
+  `troubleshooting.md` also stopped sending readers to `CLAUDE.md`, an internal file that does not
+  ship in the tarball.
+
+### Changed
+
+- **Four documentation claims stated the reverse of the source and are corrected.**
+  `spec-notes-tolerance.md`, `troubleshooting.md`, `cookbook.md` and `README.md` all said warnings and
+  errors were "PHI-free by construction" while three factories interpolated values, and two of them
+  added that a `DicomParseError` "retains no raw input snippet" while `DicomParseError.snippet`
+  carries up to 16 bytes of the source as hex and its own JSDoc says so. The messages are now safe and
+  the docs say why; the snippet is documented as the PHI it is. `troubleshooting.md` also records that
+  **value-decode warnings never reach `ds.warnings`** at all (decode is lazy, so they ride on
+  `el.value.warnings`), so a logger reading only the dataset array sees none of them.
+- **The `DeidentifyReport` is no longer described as value-free without qualification.** It is, apart
+  from `uidMap`, whose **keys are the source UIDs read out of the file** and kept so replacement stays
+  consistent across a study. A Study or SOP Instance UID is a unique identifying number; that field is
+  PHI and the rest of the report is not.
+
+- **`CHANGELOG.md` now records what each released version contained.** Every entry in this file sat
+  under `[Unreleased]` while npm served `0.0.1`, `0.0.3` and `0.0.4`, and `CHANGELOG.md` is in
+  `package.json#files`, so the file shipped inside the tarball telling a consumer that the version
+  they had installed was unreleased. That is a false claim on a distributed surface rather than
+  untidy bookkeeping. No entry's substance is rewritten: each is moved to the version that actually
+  shipped it, reconstructed from the tags, the GitHub releases, and the changesets each
+  "Version Packages" commit consumed. `0.0.2` gets no heading because it was never published: it was
+  version-bumped on 2026-07-27 and the publish that followed did not run, so its four changesets
+  reached npm inside `0.0.3` and are recorded there. That is also why npm's version list skips
+  `0.0.2`.
+
+### Added
+
+- **`DICOM_SQ_NOT_DESCENDED`**, a Tier-2 warning code (25 total, was 24). Public surface: the locked
+  `WARNING_CODES` snapshot was updated deliberately, and a profile may `escalate` or `suppress` it
+  like any other code.
+
+- **A slot table of consumer-controlled positions in the format**
+  (`test/integration/phi-diagnostic-surface.test.ts`), bound to `assertNoDiagnosticPhiLeak` from
+  `@cosyte/test-utils` (pin bumped to `^0.0.2`; a caret on a `0.0.x` resolves to that version exactly,
+  so the old pin would have tested against a kit without the runner and passed). Thirty-eight slots,
+  one test each, across all four transfer syntaxes and encapsulated pixel data, plus the de-identify
+  surface and the serialized "safe to share" bytes.
+
+  **It does not make the diagnostic surface PHI-free, and the difference matters.**
+  `DicomParseError.snippet` is 16 raw source bytes as hex on every fatal and every strict-mode
+  escalation. That is deliberate and long-standing (D-10), the docs name it as PHI, and no slot here
+  can go red on it: the runner matches verbatim echoes, and hex is a re-encoding. What the table
+  proves is that no _message_, position, thrown value or model identifier carries a planted byte.
+
+  **It was run red on the base commit and named seven leaking slots**, which is the point of it. The
+  suite it joins could not have done that: `test/property/_arbitraries.ts` blocks the leaking path
+  three independent ways, and the sharpest is that its `TEXT_ALPHABET` excludes the backslash "so a
+  single-valued element stays single-valued" - the exact byte `(0008,0005)` splits on before the
+  leaking branch. It also never generates `(0008,0005)` or a Private Creator element at all.
+
+  Two things the table pins that a marker search alone would not. Every slot names the diagnostic
+  **code** it must reach, so a probe that was quietly normalized away cannot pass as evidence; the
+  marker is invalid in `UI` and `CS`, the two VRs most worth probing here, and what makes it reach
+  those branches anyway is that this parser validates no VR character set on read. And one test
+  compares every emitted message against the **registry template** rather than searching it for the
+  marker, so any interpolation of anything at all breaks it, whatever was planted.
+
+- **`README.md` now opens with the shared Cosyte lockup, which follows the reader's color scheme**
+  (`ASSETS-P8`). A `<picture>` block above the H1 carries the dark-ground org tile behind a
+  `prefers-color-scheme: dark` media query and the light-ground tile as the inner `<img>`, so the
+  mark sits on a ground that matches the page it is read on. It replaces the per-package banner,
+  which baked the package name and the one-line tagline into pixels while the two lines directly
+  beneath it repeated both: the lockup reads "Cosyte" where the H1 reads `@cosyte/dicom`, so the
+  duplication goes and the heading stays. The alt text is content rather than decoration, because it
+  is what a screen reader reads on the npm page, and it describes the mark itself rather than
+  repeating the heading below it.
+
+  **One stated reason is corrected rather than dropped.** The per-package banner was chosen as a
+  plain markdown image, with no `<img>` and no `<picture>`, expressly because whether npm's markdown
+  sanitizer preserves a `<picture>` was unverified. It has since been measured on a published
+  package page: the `<img>` is hoisted out of its `<picture>` by npm's anchor wrapper, so the light
+  cut renders there, and npmjs.com has no dark mode, so that is the correct cut. A renderer that
+  strips `<source>` still renders the inner `<img>`, so the worst case is a light-ground mark on a
+  dark page, never a missing or broken image. Both tile URLs were rechecked with `curl -I` as
+  `200 image/png`, 10513 and 10455 bytes, before this landed, rather than taken from the `live` flag
+  in `assets/published-urls.json`, whose own `$fields.status` note says to read `live` for what it
+  is: a declaration made on evidence from another repo, never a fact checked there.
+
+## [0.0.4] - 2026-07-30
+
 ### Added
 
 - **The element registry is now generated from NEMA's PS3.6 DocBook, the normative publication**
@@ -49,69 +347,56 @@ All notable changes to `@cosyte/dicom` will be documented in this file. The form
   _content_, documented in `vendor/nema/README.md`. What is gated in CI is unchanged and offline:
   the committed dictionary must be byte-for-byte what the pinned inputs produce.
 
-- **Em-dash brand gate in CI (`EMDASH-CONFORMANCE`).** The founder directive of 2026-07-24
-  (`knowledgebase/06-brand/voice-and-tone.md`, "No em dashes. Ever.") bans `U+2014` outright across
-  every cosyte surface and names commit messages explicitly, and the meta-repo's
-  `documentation/conventions.md` has stated for weeks that the rule is CI-gated. It now actually is,
-  here: `scripts/check-no-emdash.sh` (`pnpm check:no-emdash`) plus a dedicated
-  `.github/workflows/no-emdash.yml` job that scans **both** halves the rule covers, the tracked files
-  **and** the PR title, body, and commit messages. The workflow carries the non-default `edited`
-  pull-request trigger, which is load-bearing: this repo squash-merges under
-  `squash_merge_commit_title: COMMIT_OR_PR_TITLE` and `squash_merge_commit_message: COMMIT_MESSAGES`
-  (read off the repo, not assumed), so the subject that lands on `main` is the PR title, or the lone
-  commit's subject when the branch has exactly one, and the body is the branch commit messages.
-  Without `edited` a title changed after the last push would never be re-checked. The PR body does
-  **not** land; the gate scans it anyway, as deliberate over-strictness on a surface that costs
-  nothing to cover. It is a separate workflow rather than a job in `ci.yml` because that trigger
-  would otherwise re-run the whole Node 22 + 24 matrix on every typo fix, and because the shared
-  `cosyte/.github` pipeline runs no arbitrary repo script.
-  **This one did change content, unlike the earlier ports.** An ecosystem survey had measured
-  markdown only (0 of 25 `.md` files) and read dicom as already clean. Measuring all 178 tracked
-  files found six live em dashes in four non-markdown files, all removed here (see Changed, below).
-  Measure every tracked file, because that is what the scan covers.
-  The script is the **text-only** variant, taken from `ncpdp` (PR #34, `39212bb`) rather than from
-  the older `knowledgebase` copy, so it carries `ncpdp`'s two fixes to the shared shape instead of
-  inheriting the holes: a tracked file named `-` was read by `grep` as standard input (which `xargs`
-  points at `/dev/null`) and so was never opened, and `-d skip` silently passed a tracked symlink to
-  a directory. Both are re-proved here rather than taken on faith: with the `./` path prefix removed
-  the gate prints OK and exits 0 over a live em dash in a file named `-`, and with `-d skip` restored
-  it goes green over an unread symlink.
-  It deliberately omits `grep -I`, and in this repo that is the most load-bearing flag choice in the
-  file. `src/dataset/vr/charset.ts` holds a functional NUL byte inside `/[\x00 ]+$/u`, the regex that
-  strips DICOM's own padding, so grep classifies it binary. It carries no em dash today and scans
-  green, which is the whole answer to the belief that this port was blocked: the red would come from
-  a match, never from the NUL. **If it ever gains one, the gate reds.** Measured with GNU grep 3.8:
-  grep exits 0, writes nothing to stdout, and writes `binary file matches` to stderr, so the hit
-  never reaches the hit list and the stderr capture fails the run instead. With `-I` added, the same
-  edit goes green, which is why `-I` stays out. The failure message names that case explicitly rather
-  than blaming an I/O error that did not happen.
-  A gate that prints OK when it did not read its input is worse than no gate, so nine routes by which
-  a dead or blind scan could still report green are each checked red, not assumed: a corrupt git
-  index, an unreadable tracked file, a tracked file named `-q`, a C-quoted non-ASCII path, a
-  mis-encoded text file, an empty tracked-file list, a tracked file named `-`, a tracked symlink to a
-  directory, and the NUL-bearing source file gaining an em dash.
-  Known limits are documented in the script header and inherited knowingly from the shared shape
-  rather than patched in this copy alone: encoded-form matching is literal (so `&#x2014` without the
-  semicolon, and lowercase `%e2%80%94`, pass), stderr capture binds to the scanning `grep` rather
-  than to the filters ahead of it, an em dash encoded in a non-UTF-8 charset is not matched (a live
-  possibility here, given `(0008,0005)` Specific Character Set fixtures), and the scan reads file
-  **contents** only, so a tracked path that itself carries an em dash passes. Tooling only: no
-  runtime, public-API, or parse-behavior change.
-- **`docs-content/` now covers the full canonical Diátaxis spine** (`DOCS-CONTENT-P6`). Beyond the
-  existing Overview (`intro`), the sidebar gains **Installation** and **Quickstart** (tutorials),
-  five **Core Concepts** notes (the object model, the tolerance/warning model, the typed value
-  layer, the safety-critical views, and the source-profile system), a **Guides** cookbook (four
-  recipes: re-serialize, de-identify, read raw pixel data, triage warnings), and a
-  **Troubleshooting & known limitations** reference. Every documented capability is grounded in the
-  package's actually-shipped surface; the metadata-first boundary is stated explicitly, with the
-  permanent non-goals named in Troubleshooting (**no pixel decode, no DIMSE networking, no
-  DICOMweb**, no pixel-level de-identification).
-- **Doc/code-agreement gate (`test/docs-content.test.ts`).** Every ` ```ts runnable ` snippet in
-  `docs-content/` is extracted, compiled, and executed against the **built** package via
-  `docSnippetSuite()` from `@cosyte/vitest-config/snippets`, with its inline `// =>` assertions
-  checked, so a documented example can never silently drift from the code. All examples use
-  synthetic, base64-encoded Part 10 objects (invented patient, fake UIDs); no real PHI, no `.dcm`
-  file on disk.
+### Changed
+
+- **The PS3.5 repeating-group bound is now derived from pinned normative documents rather than
+  transcribed (`DICOM-PS35-NOT-VENDORED`). No runtime impact: the emitted bound is identical and no
+  public API moves.** `deidentify()` expands PS3.15 Table E.1-1's `(50xx,xxxx)`, `(60xx,3000)` and
+  `(60xx,4000)` rows over the concrete groups PS3.5 section 7.6 admits, sixteen even groups per mask
+  (`5000`-`501E`, `6000`-`601E`), not 256. That bound is a safety limit in **both** directions, and it
+  was the last input here that lived as a **quotation in a source file** while PS3.6 and PS3.15 were
+  SHA-pinned and re-hashed before use, so the generator's guard could catch a new mask _prefix_ but
+  never a changed _bound_.
+  `vendor/nema/part05/` pins `part05.xml` (PS3.5 **2026c**) and `vendor/nema/part05-2004/` pins
+  `04_05pu.pdf`, both re-hashed as a precondition, and `scripts/generate-repeating-groups.ts` emits
+  `src/dictionary/generated/repeating-groups.ts`, which `src/dictionary/repeating-groups.ts`
+  re-exports. **Two documents, because the bound is split across two editions:** the current one
+  states the overlay bound normatively and excludes the odd `6001`-`601F`, but says nothing about the
+  curve bound, having retired curve encoding and delegated it to PS3.5-2004 by URL in section 7.6's
+  own Note. So the 2004 PDF is the authority the edition in force names, not a convenience copy. The
+  generator **proves that delegation** (section 7.6 must link exactly the vendored URL) instead of
+  assuming it, and because both editions state the overlay bound it **requires them to agree**.
+  `gen:repeating-groups` runs first in `gen:all`, since the Annex E generator expands family rows
+  through this bound.
+  **The values did not change; their falsifiability did.** Moving the overlay bound in either
+  vendored edition reds the cross-check, moving the curve bound in the 2004 edition moves the emitted
+  artifact (caught by the byte-identical regen gate), and removing the delegation link stops the 2004
+  document being used at all. Each was confirmed non-vacuous by disabling the guard and watching the
+  test fail. Reading a 2004 PDF needs a PDF reader; the one in that generator is deliberately minimal
+  (Node `zlib` only, one sentence recovered, matched against a precise expected shape) and is not to
+  be grown into a general parser. There is no staleness clock, for the same reasons as PS3.6 and
+  PS3.15.
+- **Recorded what the vendor pin is actually current against (`DICOM-DICT-CURRENCY`).**
+  `vendor/innolitics/README.md` gains a measured Currency section and drops the "re-pin monthly"
+  policy, which nothing ran and which measured the wrong thing. The pin is exactly current against
+  upstream: `git ls-remote` resolves `master` to the pinned SHA and all four vendored files are
+  byte-identical to upstream at it. Upstream itself is the stale link, having last changed
+  `attributes.json` on 2024-04-18 ("Update standard to rev2024b"), so the tag tables are grounded in
+  PS3.6 2024b while the current edition is PS3.6 2026c. The drift is now measured rather than
+  assumed, against the NEMA DocBook source for 2026c, and every non-additive difference is named in
+  that file. Figures on `86ab6c1` (`origin/main` at measurement time; this slice does not touch
+  `tags.ts` or `keywords.ts`): all **5,129** committed tags are shared with PS3.6 2026c, and across
+  them there are **zero VR differences**, zero name differences and zero VM differences, with 2
+  keyword and 2 retirement-status differences. **Every tag this dictionary carries is still in
+  PS3.6 2026c**; the drift is otherwise purely additive, 180 tags the standard has gained. VR is
+  what turns bytes into a value, so zero VR drift is the result that matters for reading a real
+  study. Nothing in the dictionary is hand-edited to close the gap: it is generated, and the
+  remaining differences are recorded for the next re-pin. One method note lives with the
+  measurement, because getting it wrong is easy and was got wrong on the first run: DICOM tag values
+  are hexadecimal and their case is not semantic, so tag keys must be compared case-insensitively.
+  PS3.6 prints them uniformly uppercase and `tags.ts` agrees on 1,540 of its 5,129 keys, but
+  `tags.ts` lowercases the 8 repeating-group keys whose trailing digits are hex letters and no
+  others, so a verbatim comparison mis-classifies exactly those 8.
 
 ### Fixed
 
@@ -274,56 +559,84 @@ All notable changes to `@cosyte/dicom` will be documented in this file. The form
   and a chained clean would leave the working tree empty and the build broken. The gate does its own
   delete rather than trusting the script under test.
 
-### Changed
+## [0.0.3] - 2026-07-27
 
-- **The PS3.5 repeating-group bound is now derived from pinned normative documents rather than
-  transcribed (`DICOM-PS35-NOT-VENDORED`). No runtime impact: the emitted bound is identical and no
-  public API moves.** `deidentify()` expands PS3.15 Table E.1-1's `(50xx,xxxx)`, `(60xx,3000)` and
-  `(60xx,4000)` rows over the concrete groups PS3.5 section 7.6 admits, sixteen even groups per mask
-  (`5000`-`501E`, `6000`-`601E`), not 256. That bound is a safety limit in **both** directions, and it
-  was the last input here that lived as a **quotation in a source file** while PS3.6 and PS3.15 were
-  SHA-pinned and re-hashed before use, so the generator's guard could catch a new mask _prefix_ but
-  never a changed _bound_.
-  `vendor/nema/part05/` pins `part05.xml` (PS3.5 **2026c**) and `vendor/nema/part05-2004/` pins
-  `04_05pu.pdf`, both re-hashed as a precondition, and `scripts/generate-repeating-groups.ts` emits
-  `src/dictionary/generated/repeating-groups.ts`, which `src/dictionary/repeating-groups.ts`
-  re-exports. **Two documents, because the bound is split across two editions:** the current one
-  states the overlay bound normatively and excludes the odd `6001`-`601F`, but says nothing about the
-  curve bound, having retired curve encoding and delegated it to PS3.5-2004 by URL in section 7.6's
-  own Note. So the 2004 PDF is the authority the edition in force names, not a convenience copy. The
-  generator **proves that delegation** (section 7.6 must link exactly the vendored URL) instead of
-  assuming it, and because both editions state the overlay bound it **requires them to agree**.
-  `gen:repeating-groups` runs first in `gen:all`, since the Annex E generator expands family rows
-  through this bound.
-  **The values did not change; their falsifiability did.** Moving the overlay bound in either
-  vendored edition reds the cross-check, moving the curve bound in the 2004 edition moves the emitted
-  artifact (caught by the byte-identical regen gate), and removing the delegation link stops the 2004
-  document being used at all. Each was confirmed non-vacuous by disabling the guard and watching the
-  test fail. Reading a 2004 PDF needs a PDF reader; the one in that generator is deliberately minimal
-  (Node `zlib` only, one sentence recovered, matched against a precise expected shape) and is not to
-  be grown into a general parser. There is no staleness clock, for the same reasons as PS3.6 and
-  PS3.15.
-- **Recorded what the vendor pin is actually current against (`DICOM-DICT-CURRENCY`).**
-  `vendor/innolitics/README.md` gains a measured Currency section and drops the "re-pin monthly"
-  policy, which nothing ran and which measured the wrong thing. The pin is exactly current against
-  upstream: `git ls-remote` resolves `master` to the pinned SHA and all four vendored files are
-  byte-identical to upstream at it. Upstream itself is the stale link, having last changed
-  `attributes.json` on 2024-04-18 ("Update standard to rev2024b"), so the tag tables are grounded in
-  PS3.6 2024b while the current edition is PS3.6 2026c. The drift is now measured rather than
-  assumed, against the NEMA DocBook source for 2026c, and every non-additive difference is named in
-  that file. Figures on `86ab6c1` (`origin/main` at measurement time; this slice does not touch
-  `tags.ts` or `keywords.ts`): all **5,129** committed tags are shared with PS3.6 2026c, and across
-  them there are **zero VR differences**, zero name differences and zero VM differences, with 2
-  keyword and 2 retirement-status differences. **Every tag this dictionary carries is still in
-  PS3.6 2026c**; the drift is otherwise purely additive, 180 tags the standard has gained. VR is
-  what turns bytes into a value, so zero VR drift is the result that matters for reading a real
-  study. Nothing in the dictionary is hand-edited to close the gap: it is generated, and the
-  remaining differences are recorded for the next re-pin. One method note lives with the
-  measurement, because getting it wrong is easy and was got wrong on the first run: DICOM tag values
-  are hexadecimal and their case is not semantic, so tag keys must be compared case-insensitively.
-  PS3.6 prints them uniformly uppercase and `tags.ts` agrees on 1,540 of its 5,129 keys, but
-  `tags.ts` lowercases the 8 repeating-group keys whose trailing digits are hex letters and no
-  others, so a verbatim comparison mis-classifies exactly those 8.
+This release carries two version bumps' worth of change. `0.0.2` was bumped on the same day and
+never published, so the four changesets it consumed reached npm here, in `0.0.3`, together with
+the regen-gate repair below.
+
+### Added
+
+- **Em-dash brand gate in CI (`EMDASH-CONFORMANCE`).** The founder directive of 2026-07-24
+  (`knowledgebase/06-brand/voice-and-tone.md`, "No em dashes. Ever.") bans `U+2014` outright across
+  every cosyte surface and names commit messages explicitly, and the meta-repo's
+  `documentation/conventions.md` has stated for weeks that the rule is CI-gated. It now actually is,
+  here: `scripts/check-no-emdash.sh` (`pnpm check:no-emdash`) plus a dedicated
+  `.github/workflows/no-emdash.yml` job that scans **both** halves the rule covers, the tracked files
+  **and** the PR title, body, and commit messages. The workflow carries the non-default `edited`
+  pull-request trigger, which is load-bearing: this repo squash-merges under
+  `squash_merge_commit_title: COMMIT_OR_PR_TITLE` and `squash_merge_commit_message: COMMIT_MESSAGES`
+  (read off the repo, not assumed), so the subject that lands on `main` is the PR title, or the lone
+  commit's subject when the branch has exactly one, and the body is the branch commit messages.
+  Without `edited` a title changed after the last push would never be re-checked. The PR body does
+  **not** land; the gate scans it anyway, as deliberate over-strictness on a surface that costs
+  nothing to cover. It is a separate workflow rather than a job in `ci.yml` because that trigger
+  would otherwise re-run the whole Node 22 + 24 matrix on every typo fix, and because the shared
+  `cosyte/.github` pipeline runs no arbitrary repo script.
+  **This one did change content, unlike the earlier ports.** An ecosystem survey had measured
+  markdown only (0 of 25 `.md` files) and read dicom as already clean. Measuring all 178 tracked
+  files found six live em dashes in four non-markdown files, all removed here (see Changed, below).
+  Measure every tracked file, because that is what the scan covers.
+  The script is the **text-only** variant, taken from `ncpdp` (PR #34, `39212bb`) rather than from
+  the older `knowledgebase` copy, so it carries `ncpdp`'s two fixes to the shared shape instead of
+  inheriting the holes: a tracked file named `-` was read by `grep` as standard input (which `xargs`
+  points at `/dev/null`) and so was never opened, and `-d skip` silently passed a tracked symlink to
+  a directory. Both are re-proved here rather than taken on faith: with the `./` path prefix removed
+  the gate prints OK and exits 0 over a live em dash in a file named `-`, and with `-d skip` restored
+  it goes green over an unread symlink.
+  It deliberately omits `grep -I`, and in this repo that is the most load-bearing flag choice in the
+  file. `src/dataset/vr/charset.ts` holds a functional NUL byte inside `/[\x00 ]+$/u`, the regex that
+  strips DICOM's own padding, so grep classifies it binary. It carries no em dash today and scans
+  green, which is the whole answer to the belief that this port was blocked: the red would come from
+  a match, never from the NUL. **If it ever gains one, the gate reds.** Measured with GNU grep 3.8:
+  grep exits 0, writes nothing to stdout, and writes `binary file matches` to stderr, so the hit
+  never reaches the hit list and the stderr capture fails the run instead. With `-I` added, the same
+  edit goes green, which is why `-I` stays out. The failure message names that case explicitly rather
+  than blaming an I/O error that did not happen.
+  A gate that prints OK when it did not read its input is worse than no gate, so nine routes by which
+  a dead or blind scan could still report green are each checked red, not assumed: a corrupt git
+  index, an unreadable tracked file, a tracked file named `-q`, a C-quoted non-ASCII path, a
+  mis-encoded text file, an empty tracked-file list, a tracked file named `-`, a tracked symlink to a
+  directory, and the NUL-bearing source file gaining an em dash.
+  Known limits are documented in the script header and inherited knowingly from the shared shape
+  rather than patched in this copy alone: encoded-form matching is literal (so `&#x2014` without the
+  semicolon, and lowercase `%e2%80%94`, pass), stderr capture binds to the scanning `grep` rather
+  than to the filters ahead of it, an em dash encoded in a non-UTF-8 charset is not matched (a live
+  possibility here, given `(0008,0005)` Specific Character Set fixtures), and the scan reads file
+  **contents** only, so a tracked path that itself carries an em dash passes. Tooling only: no
+  runtime, public-API, or parse-behavior change.
+- **`docs-content/` now covers the full canonical Diátaxis spine** (`DOCS-CONTENT-P6`). Beyond the
+  existing Overview (`intro`), the sidebar gains **Installation** and **Quickstart** (tutorials),
+  five **Core Concepts** notes (the object model, the tolerance/warning model, the typed value
+  layer, the safety-critical views, and the source-profile system), a **Guides** cookbook (four
+  recipes: re-serialize, de-identify, read raw pixel data, triage warnings), and a
+  **Troubleshooting & known limitations** reference. Every documented capability is grounded in the
+  package's actually-shipped surface; the metadata-first boundary is stated explicitly, with the
+  permanent non-goals named in Troubleshooting (**no pixel decode, no DIMSE networking, no
+  DICOMweb**, no pixel-level de-identification).
+- **Doc/code-agreement gate (`test/docs-content.test.ts`).** Every ` ```ts runnable ` snippet in
+  `docs-content/` is extracted, compiled, and executed against the **built** package via
+  `docSnippetSuite()` from `@cosyte/vitest-config/snippets`, with its inline `// =>` assertions
+  checked, so a documented example can never silently drift from the code. All examples use
+  synthetic, base64-encoded Part 10 objects (invented patient, fake UIDs); no real PHI, no `.dcm`
+  file on disk.
+- **Trademark notice (`TRADEMARKS.md`).** This package names third-party systems to describe what it
+  interoperates with; the notice records that cosyte is not affiliated with, endorsed by, or
+  sponsored by any of them, that every reference is descriptive, and that the built-in profiles are
+  authored from public sources only. Added to `files` so it ships inside the published tarball, not
+  just on GitHub. Documentation only: no runtime or API change.
+
+### Changed
 
 - **Removed the six em dashes the new gate found (`EMDASH-CONFORMANCE`).** Four tracked files, none
   of them markdown: `.github/CODEOWNERS` (2), `.github/workflows/release.yml` (2),
@@ -379,7 +692,8 @@ All notable changes to `@cosyte/dicom` will be documented in this file. The form
   therefore "a no-op until that flag is removed". `package.json` carries no `private` field, the repo
   is public, and the package ships on npm at `0.0.1`, so the comment described the release pipeline as
   inert when it is live. Documentation only, no behavior change, but a misleading note on a workflow
-  that really does publish is worth more than a stale one elsewhere.
+  that really does publish is worth more than a stale one elsewhere. (`0.0.1` was the published
+  version on that date.)
 
 - **Corrected stale publish-status language in `docs-content/` (`README-ORG-SWEEP`).**
   `installation.md` claimed the package was "not yet published to npm" and that the install command
@@ -387,57 +701,13 @@ All notable changes to `@cosyte/dicom` will be documented in this file. The form
   published … not on npm; the first provenance publish is gated on the coordinated public launch"
   non-goal. `@cosyte/dicom` is published on npm at `0.0.1` and public. Both now state the truth
   (published, public, still pre-alpha on the `0.0.x`-until-first-alpha ladder), and the troubleshooting
-  bullet becomes an honest pin-your-version pre-alpha caveat rather than a stale non-goal.
-
-- **`private: true` removed: `@cosyte/dicom` can publish.** The flag dated to the very first
-  scaffold commit and was never explained; `changeset publish` silently skips a private package, so
-  this repo was the one parser that could not reach npm even once its pipeline worked. It also
-  contradicted the `publishConfig: { access: "public" }` in the same file. Removed as part of the
-  coordinated public launch (`PUB-FLIP`).
+  bullet becomes an honest pin-your-version pre-alpha caveat rather than a stale non-goal. (`0.0.1`
+  was the published version on that date; `npm view @cosyte/dicom version` is the current one.)
 
-- **The release can actually bump the version.** `package.json` had no `version` script, so the
-  shared pipeline's `pnpm run version` failed with `Command "version" not found` and the release
-  aborted before opening a "Version Packages" PR. Adds `scripts/sync-version.mjs` (the `hl7`
-  reference, retargeted at `src/version.ts`) and the `version` script that runs it after
-  `changeset version`, so the bump and the `VERSION` constant land in the same commit.
-- **`VERSION` is no longer typed as a string literal.** It was declared `export const VERSION =
-"0.0.0"`, giving it the literal type `"0.0.0"`, so the exported type would change on every
-  release, making each version bump a breaking type change. Now annotated `: string`, matching the
-  `hl7` reference. Type-only; the runtime value is unchanged. Done now because the package is
-  unpublished. After the first publish this would itself be a breaking change.
-
-- **The Release workflow can actually start.** `.github/workflows/release.yml` calls the shared
-  `cosyte/.github` pipeline, which requests `contents`/`id-token`/`pull-requests: write`, but declared
-  no `permissions:` of its own, so it inherited the repo default of `contents: read`. A called
-  workflow may only downgrade the caller's `GITHUB_TOKEN`, never escalate it, so GitHub rejected the
-  workflow at startup (~1s, no jobs, no logs). Every Release run from June 2026 until now failed this
-  way, unnoticed, because a `startup_failure` produces no logs to read. The caller job now declares
-  the three scopes explicitly. CI-only: no runtime or API change.
-
-### Security
-
-- **Dev-dependency advisory remediation (no runtime impact: the published
-  artifact is unchanged).** Added scoped `pnpm.overrides` pinning two
-  transitive **dev/build-time** packages to their patched releases: `esbuild`
-  (`>=0.27.3 <0.28.1` → `0.28.1`; GHSA dev-server path-traversal, not
-  reachable here: the library builds via `tsup`/`vitest` and never runs
-  `esbuild serve`) and the `@changesets/parse` copy of `js-yaml`
-  (`>=4.0.0 <4.2.0` → `4.2.0`; GHSA-h67p-54hq-rp68 merge-key DoS). The
-  `js-yaml@3.14.2` pulled by `read-yaml-file@1.1.0` (via
-  `@manypkg/get-packages` → `@changesets/cli`) is **intentionally left**: it
-  calls `yaml.safeLoad`, removed/throwing in js-yaml 4, so it cannot be
-  force-upgraded without breaking the release tooling, and it only parses
-  trusted local repo YAML at release time. This is the shared canonical
-  override block, enforced suite-wide by the `@cosyte/config` drift check.
+## [0.0.1] - 2026-07-17
 
 ### Added
 
-- **Trademark notice (`TRADEMARKS.md`).** This package names third-party systems to describe what it
-  interoperates with; the notice records that cosyte is not affiliated with, endorsed by, or
-  sponsored by any of them, that every reference is descriptive, and that the built-in profiles are
-  authored from public sources only. Added to `files` so it ships inside the published tarball, not
-  just on GitHub. Documentation only: no runtime or API change.
-
 - **Lossless File Meta round-trip.** The parser now retains non-modeled
   `(0002,xxxx)` File Meta elements (e.g. `(0002,0017)`/`(0002,0018)`
   Sending/Receiving AE Title, `(0002,0100)` Private Information Creator UID,
@@ -519,28 +789,6 @@ All notable changes to `@cosyte/dicom` will be documented in this file. The form
   built only from the code + the offending Transfer Syntax UID (structural facts), never a decoded
   value, so it is always safe to log. New public exports: `serializeDicom`, `DicomSerializeError`,
   `SERIALIZE_ERROR_CODES`, `SerializeErrorCode`.
-
-### Known limitations
-
-- **File Meta round-trip is over the modeled surface, not byte-exact.** Only the typed `FileMeta`
-  fields round-trip; any other `(0002,xxxx)` element a source file carried (e.g. `(0002,0100)` Private
-  Information Creator UID) is dropped at _parse_ time (the Phase 2 `FileMeta` view does not model it)
-  and so cannot be re-emitted. The preamble is normalized to zeros and odd-length values are padded
-  even. The output stays spec-clean but is not a byte-identical copy of a non-conformant input.
-
-### Tests
-
-- **Enhanced multi-frame coverage (DICOM-COV).** Closed the Per-Frame-else-Shared branch gaps left by
-  the Phase 4 functional-group resolver (`functional-groups.ts`: ~53% → 100% branch): both optional
-  macros (Pixel Value Transformation `(0028,9145)`, Frame VOI LUT `(0028,9132)`), Pixel Measures
-  `spacingBetweenSlices`, shared-only resolution (no Per-Frame Functional Groups Sequence), the
-  lenient inner-attribute-absence paths (a macro item present but its attributes omitted ⇒ typed-absent,
-  never coerced), and all three `MISSING_REQUIRED_FUNCTIONAL_GROUP` throws (Pixel Measures / Plane
-  Position / Plane Orientation). Synthetic fixtures only; no public-surface change. Per-directory
-  coverage now sits genuinely ≥ 90 on every gated directory (global branches 93.2%).
-
-### Added
-
 - **Safety-critical domain helpers (Phase 4).** New `Dataset` accessors `patient` / `study` /
   `series` / `image` return typed, fail-safe views over the DICOM §4 safety-critical attributes
   (memoized on first access). `patient` surfaces the `{id, issuerOfId, issuerQualifiers}` identity
@@ -605,3 +853,68 @@ All notable changes to `@cosyte/dicom` will be documented in this file. The form
 - CI/release workflows reduced to thin callers of the reusable `cosyte/.github` pipelines
   (`ci.yml` runs the shared PHI scan; `release.yml` targets `@cosyte/dicom`). The repo-specific
   byte-identical dictionary-regen workflow is kept and bumped to Node 22.
+
+### Fixed
+
+- **`private: true` removed: `@cosyte/dicom` can publish.** The flag dated to the very first
+  scaffold commit and was never explained; `changeset publish` silently skips a private package, so
+  this repo was the one parser that could not reach npm even once its pipeline worked. It also
+  contradicted the `publishConfig: { access: "public" }` in the same file. Removed as part of the
+  coordinated public launch (`PUB-FLIP`).
+
+- **The release can actually bump the version.** `package.json` had no `version` script, so the
+  shared pipeline's `pnpm run version` failed with `Command "version" not found` and the release
+  aborted before opening a "Version Packages" PR. Adds `scripts/sync-version.mjs` (the `hl7`
+  reference, retargeted at `src/version.ts`) and the `version` script that runs it after
+  `changeset version`, so the bump and the `VERSION` constant land in the same commit.
+- **`VERSION` is no longer typed as a string literal.** It was declared `export const VERSION =
+"0.0.0"`, giving it the literal type `"0.0.0"`, so the exported type would change on every
+  release, making each version bump a breaking type change. Now annotated `: string`, matching the
+  `hl7` reference. Type-only; the runtime value is unchanged. Done now because the package is
+  unpublished. After the first publish this would itself be a breaking change.
+
+- **The Release workflow can actually start.** `.github/workflows/release.yml` calls the shared
+  `cosyte/.github` pipeline, which requests `contents`/`id-token`/`pull-requests: write`, but declared
+  no `permissions:` of its own, so it inherited the repo default of `contents: read`. A called
+  workflow may only downgrade the caller's `GITHUB_TOKEN`, never escalate it, so GitHub rejected the
+  workflow at startup (~1s, no jobs, no logs). Every Release run from June 2026 until now failed this
+  way, unnoticed, because a `startup_failure` produces no logs to read. The caller job now declares
+  the three scopes explicitly. CI-only: no runtime or API change.
+
+### Security
+
+- **Dev-dependency advisory remediation (no runtime impact: the published
+  artifact is unchanged).** Added scoped `pnpm.overrides` pinning two
+  transitive **dev/build-time** packages to their patched releases: `esbuild`
+  (`>=0.27.3 <0.28.1` → `0.28.1`; GHSA dev-server path-traversal, not
+  reachable here: the library builds via `tsup`/`vitest` and never runs
+  `esbuild serve`) and the `@changesets/parse` copy of `js-yaml`
+  (`>=4.0.0 <4.2.0` → `4.2.0`; GHSA-h67p-54hq-rp68 merge-key DoS). The
+  `js-yaml@3.14.2` pulled by `read-yaml-file@1.1.0` (via
+  `@manypkg/get-packages` → `@changesets/cli`) is **intentionally left**: it
+  calls `yaml.safeLoad`, removed/throwing in js-yaml 4, so it cannot be
+  force-upgraded without breaking the release tooling, and it only parses
+  trusted local repo YAML at release time. This is the shared canonical
+  override block, enforced suite-wide by the `@cosyte/config` drift check.
+
+### Tests
+
+- **Enhanced multi-frame coverage (DICOM-COV).** Closed the Per-Frame-else-Shared branch gaps left by
+  the Phase 4 functional-group resolver (`functional-groups.ts`: ~53% → 100% branch): both optional
+  macros (Pixel Value Transformation `(0028,9145)`, Frame VOI LUT `(0028,9132)`), Pixel Measures
+  `spacingBetweenSlices`, shared-only resolution (no Per-Frame Functional Groups Sequence), the
+  lenient inner-attribute-absence paths (a macro item present but its attributes omitted ⇒ typed-absent,
+  never coerced), and all three `MISSING_REQUIRED_FUNCTIONAL_GROUP` throws (Pixel Measures / Plane
+  Position / Plane Orientation). Synthetic fixtures only; no public-surface change. Per-directory
+  coverage now sits genuinely ≥ 90 on every gated directory (global branches 93.2%).
+
+### Known limitations
+
+- **File Meta round-trip is over the modeled surface, not byte-exact.** Only the typed `FileMeta`
+  fields round-trip; any other `(0002,xxxx)` element a source file carried (e.g. `(0002,0100)` Private
+  Information Creator UID) is dropped at _parse_ time (the Phase 2 `FileMeta` view does not model it)
+  and so cannot be re-emitted. The preamble is normalized to zeros and odd-length values are padded
+  even. The output stays spec-clean but is not a byte-identical copy of a non-conformant input.
+  **Superseded within this same release** by the lossless File Meta round-trip above, which landed
+  after the serializer and before `0.0.1` was cut: as published, `0.0.1` preserves and re-emits non-modeled
+  `(0002,xxxx)` elements. The entry is kept because it is what the serializer shipped with.