@massu/core 2.2.0 → 2.3.1

package/CHANGELOG.md

@@ -10,6 +10,53 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 > redistributed under the **Apache License 2.0**. Full license + NOTICE:
 > `packages/core/assets/embedder/MODEL-LICENSE`.
 
+## [2.3.1] - 2026-07-23
+
+### Fixed
+
+- **Anti-vacuity verification repairs — seven registered gates were listed as proven-can-fail
+  while exercising nothing.** A full DEFEAT sweep (the first to run to completion in some time)
+  found seven `gate-registry.json` plants whose patterns no longer matched their target source, so
+  the "planted defect" mutated nothing and the guarded test stayed green under it. Causes were
+  benign source edits the plants were never updated for: a retuned timeout constant, an engines
+  floor bump, an import gaining a symbol, a check being renamed, and a version pinned as a literal
+  (which rots every release by design). All seven re-derived as rot-proof patterns (character
+  classes, `\d` groups, `\g<0>` back-references) and individually DEFEAT-proven.
+- **New `gate-plant-liveness-drift-guard`** asserts every plant pattern still matches its target,
+  so this rot fails in `npm test` in ~23ms instead of an hour into CI — and only against
+  git-tracked targets, since build artifacts are legitimately absent on a fresh checkout.
+- **`.git/hooks/pre-push` now runs the 22-gate battery.** It was previously manual: `.git/hooks/`
+  held only `*.sample`, so nothing invoked `scripts/pre-push-light.sh` on `git push` and gate
+  `[20/22] Incident Coverage` (CR-62) never ran. Incident:
+  `docs/incidents/2026-07-23-unenforced-pre-push-gates-and-guard-validated-against-local-state.md`.
+
+No runtime behaviour of `@massu/core` changes in this release; it is verification-infrastructure
+only. Published because CR-64 forbids commits sitting on top of a published, tagged release.
+
+## [2.3.0] - 2026-07-23
+
+### Fixed
+
+- **Corrected the `node:sqlite` Node floor `22.13.0 → 22.16.0` — the true version where the
+  built-in engine gains FTS5 AND `DatabaseSync.isTransaction`.** `2.0.0` (CR-69) made Node's
+  built-in `node:sqlite` the default DB engine and set the floor to `>=22.13.0` on the belief
+  that FTS5 was available there. It is not: `node:sqlite` is flag-free from 22.13.0, but Node
+  enabled the `SQLITE_ENABLE_FTS5` compile flag **and** added `DatabaseSync.prototype.isTransaction`
+  in the **same release, 22.16.0** (22.15.1 has neither; identical bundled SQLite 3.49.1 — a Node
+  build-config change). Below 22.16 the memory DB's `observations_fts` virtual table cannot be
+  created (`no such module: fts5`) and the nested-savepoint adapter throws `cannot start a
+  transaction within a transaction`. **Installs on Node 22.13–22.15 never had a working default DB
+  engine.** This release raises `engines.node` to `>=22.16.0` in `@massu/core` and both adapters
+  (`@massu/adapter-rails` / `@massu/adapter-spring` → `1.1.0`, CR-71 coherence), moves every CI pin
+  to the true floor (`22.16.0`, tested AT the real floor — not latest-22.x), and adds a real
+  can-fail capability drift-guard (`node-sqlite-capability-floor.test.ts`) that exercises FTS5 +
+  `isTransaction` at the pinned floor Node so a future floor drop fails loudly. Also repairs 6
+  `windows-latest`-only node-bootstrap test-fixtures from the 2.2.0 work (glob-separator,
+  none-found isolation, remedy-regex, re-exec stdin fidelity). Semver: MINOR (a floor *correction*
+  — no working support in 22.13–22.15 is removed). Incident:
+  `docs/incidents/2026-07-23-node-sqlite-fts5-floor-wrong.md`.
+  (plan-2026-07-23-node-sqlite-fts5-floor-correction)
+
 ## [2.2.0] - 2026-07-22
 
 ### Added