@starci/hfs 4.7.44 → 4.7.46

package/runtime/scripts/gates/commit-proof.mjs

@@ -1,53 +0,0 @@
-// commit-proof.mjs — locations and file IO for a commit's verification and release evidence. Each producer owns its schema.
-import fs from 'node:fs';
-import path from 'node:path';
-import { runtimeStateDir, starciLocalRoot } from '../../engine/runtime-root.mjs';
-import { sha256 } from '../../engine/digest.mjs';
-import { readJsonFile } from '../lib/json.mjs';
-import { sameResolvedPath } from '../lib/path-key.mjs';
-import { writeJsonFile } from '../api/fs/write-json-file.mjs';
-
-const RELEASE_KINDS = Object.freeze({ l4: 'l4', affected: 'affected', rows: 'l4-rows', ci: 'ci', report: 'affected-report' });
-const SHORT = 12;
-/** The local git note namespace used to write and read land proof. */
-export const LAND_NOTE_REF = 'land';
-
-/** The directory shared by release proofs of every worktree of a repository. */
-const proofDirOf = (commonDir) => path.join(commonDir, 'starci-release');
-
-/** The location of an affected, verify, deploy/check or release receipt; existing references keep their established paths. */
-export function proofFileOf({ kind, sha, base, root, env, commonDir }) {
-  if (kind === 'verify') return path.join(runtimeStateDir(root), 'verify', `${sha}.json`);
-  if (kind === 'affected-receipt') return path.join(runtimeStateDir(root), 'affected', `${String(base).slice(0, SHORT)}-${String(sha).slice(0, SHORT)}.json`);
-  if (kind === 'deploy') return path.join(starciLocalRoot(env), 'deploy', 'receipts', `${sha}.json`);
-  if (!Object.hasOwn(RELEASE_KINDS, kind)) throw new Error(`unknown commit proof kind: ${kind}`);
-  return path.join(proofDirOf(commonDir), `${sha}.${RELEASE_KINDS[kind]}.json`);
-}
-
-/** Every release proof of one kind under the git common directory, or [] when the directory is absent. */
-export function proofFilesOf({ commonDir, kind }) {
-  if (!Object.hasOwn(RELEASE_KINDS, kind)) throw new Error(`unknown release proof kind: ${kind}`);
-  const folder = proofDirOf(commonDir);
-  const suffix = `.${RELEASE_KINDS[kind]}.json`;
-  return fs.existsSync(folder) ? fs.readdirSync(folder).filter((name) => name.endsWith(suffix)).map((name) => path.join(folder, name)) : [];
-}
-
-/** Writes one receipt atomically; a reader sees a complete JSON document. Returns its file. */
-export function writeProofFile(file, record) {
-  const tmp = `${file}.${process.pid}.tmp`;
-  writeJsonFile(tmp, record);
-  fs.renameSync(tmp, file);
-  return file;
-}
-
-/** A proof file's parsed document, or null when it is missing, unreadable or malformed; its producer validates the schema. */
-export const readProofFile = (file) => readJsonFile(file, null);
-
-/** The digest of the schema's ordered binding fields. */
-export const proofDigest = (fields) => sha256(fields.join('\n'));
-
-/** Whether a receipt binds the requested commit and tree. */
-export const proofBinds = (record, { sha, tree }) => record?.sha === sha && record?.tree === tree;
-
-/** Whether the specs judged this source root; a missing root never supplies proof for another checkout. */
-export const judgedIn = (recorded, root) => typeof recorded === 'string' && recorded !== '' && sameResolvedPath(recorded, root);

package/runtime/scripts/guards/release-definition.mjs

@@ -1,204 +0,0 @@
-// release-definition.mjs - what makes a commit of the runtime repository a RELEASE commit, the one definition shared by the
-// pre-push hook (scripts/guards/release-push-gate.mjs) and the release cut (scripts/supervisor/release-cut.mjs). The remote
-// main of the runtime moves exactly when a release is cut, so a push of main or of a v* tag is judged against this list:
-//   RELEASE_VERSION_UNCHANGED   package.json `version` at the pushed commit differs from the version at the remote main's head
-//   RELEASE_VERSION_NOT_NEXT    that version is the next release after the highest v* tag (scripts/lib/release-version.mjs, owner ruling release-waves):
-//                               the next wave alpha.N.M+1 of its line or the next line alpha.N+1, never the legacy -fix form
-//   RELEASE_TAG_VERSION         the release tag is v<version> of the pushed commit
-//   RELEASE_CHANGELOG_SECTION   CHANGELOG.md holds `## [<version>] - <date>` (a dated heading) with no unfinished marker (R222)
-//   RELEASE_TAG_MISSING         an ANNOTATED tag v<version> points at the pushed commit
-//   RELEASE_RECEIPT_MISSING     the L4 record of exactly this commit (scripts/guards/release-record.mjs, written by the cut) names this tag
-//   RELEASE_RECEIPT_INCOMPLETE  that record holds a green row for each of RECEIPT_STEPS (the package clean-test, the scaffold e2e and the checks) (RAN on this commit or reused from another with the identical input digest, the record's `reusedFrom` names it; owner ruling speed-flow, 2026-10-25)
-//   RELEASE_SUITE_MODE          the record says `suite: ci` (the Linux parity delegated to CI) while the checked-out config says `local`, or it lists no delegated linux-parity: a record never claims the mode by
-//                               itself (scripts/guards/release-suite-mode.mjs); both modes ask for the same root rows, the runtime has no spec suite to delegate (owner ruling no-runtime-specs)
-// Each finding names what is missing and the command that produces it. Pure over the git reads; no bypass.
-import { catFile } from '../api/git/cat-file.mjs';
-import { revParseQuery } from '../api/git/rev-parse-query.mjs';
-import { show } from '../api/git/show.mjs';
-import { tag as gitTag } from '../api/git/tag.mjs';
-import { mergeBaseQuery } from '../api/git/merge-base-query.mjs';
-import { pathKey, realPath } from '../lib/path-key.mjs';
-import { changelogSection, releaseNotesFindings } from '../hfs/runtime-rules/release-notes.mjs';
-import { nextReleases, releaseVersionRefusal, taggedVersions } from '../lib/release-version.mjs';
-import { readL4Record } from './release-record.mjs';
-import { suiteModeOf } from './release-suite-mode.mjs';
-
-/** The rows the L4 record must hold green, run on the commit or reused from an identical-digest row of another, in either suite mode: the package clean-test, the scaffold e2e and the checks (the runtime's real tests). */
-export const RECEIPT_STEPS = Object.freeze(['npm run test:packages', 'npm run test:e2e', 'npm run check']);
-const CUT_COMMAND = (tag) => `starci release cut --tag ${tag}`;
-const REGEX_SPECIALS = /[.*+?^$()|[\]{}\\]/g;
-const HEADING_HEAD = String.raw`^## \[`;
-const DATED_HEADING_TAIL = String.raw`\] — \d{4}-\d{2}-\d{2}\s*$`;
-const DATED_HEADING = (version) => new RegExp([HEADING_HEAD, version.replaceAll(REGEX_SPECIALS, String.raw`\$&`), DATED_HEADING_TAIL].join(''), 'mu');
-
-const finding = (code, missing, fix) => ({ code, missing, fix });
-const gitText = (verb, args, cwd) => {
-  const r = verb(args, { cwd, timeout: 60_000 });
-  return r.status === 0 ? String(r.stdout ?? '') : null;
-};
-
-/** The package.json version of `commit`, or null when the commit or its manifest cannot be read. */
-export function versionAt(cwd, commit) {
-  const text = gitText(show, [`${commit}:package.json`], cwd);
-  try { return text === null ? null : JSON.parse(text).version ?? null; } catch { return null; }
-}
-
-const releaseUnknown = (why) => ({ ok: false, status: 'unknown', why });
-const ineligibleRelease = (explicit, why) => explicit ? releaseUnknown(why) : { ok: true, candidate: null };
-
-/** A runtime Git root's nearest annotated, manifest-bound release; enclosing application history is inapplicable. */
-export function releaseTagOf({ repo, tag = null, excludeHead = false }) {
-  const history = runtimeGitHistory(repo);
-  if (!history.ok) return history;
-  const listed = tag === null ? gitText(gitTag, ['--merged', 'HEAD', '--list', 'v*'], repo) : tag;
-  if (listed === null) return releaseUnknown('release tags are unreadable');
-  const candidates = [];
-  for (const named of listed.split(/\r?\n/).filter(Boolean)) {
-    const result = releaseCandidate({ repo, named, current: history.head, explicit: tag !== null, excludeHead });
-    if (!result.ok) return result;
-    if (result.candidate) candidates.push(result.candidate);
-  }
-  return nearestRelease(repo, candidates);
-}
-
-/** Runtime history exists only at its own Git top-level with a readable HEAD and full ancestry. */
-function runtimeGitHistory(repo) {
-  const top = revParseQuery(['--show-toplevel'], { cwd: repo });
-  if (top.status !== 0) {
-    if (/not a git repository/i.test(String(top.stderr ?? ''))) return { ok: false, status: 'no-repository', why: 'release history requires a Git repository' };
-    return releaseUnknown('release repository identity is unreadable');
-  }
-  const gitRoot = String(top.stdout ?? '').trim();
-  if (!gitRoot) return releaseUnknown('release repository root is unreadable');
-  if (pathKey(realPath(gitRoot)) !== pathKey(realPath(repo))) return { ok: false, status: 'no-runtime-repository', why: 'the runtime copy is inside an enclosing Git repository; its history belongs to that repository' };
-  const head = gitText(revParseQuery, ['HEAD'], repo)?.trim();
-  if (!head) return releaseUnknown('release history HEAD is unreadable');
-  if (gitText(revParseQuery, ['--is-shallow-repository'], repo)?.trim() !== 'false') return releaseUnknown('release history is shallow or unreadable; fetch complete release history');
-  return { ok: true, head };
-}
-
-/** A candidate binds annotation, peeled commit, manifest spelling and ancestry; default discovery omits ineligible tags. */
-function releaseCandidate({ repo, named, current, explicit, excludeHead }) {
-  const kind = gitText(catFile, ['-t', `refs/tags/${named}`], repo)?.trim();
-  const head = gitText(revParseQuery, [`refs/tags/${named}^{commit}`], repo)?.trim();
-  if (!kind || !head) return releaseUnknown(`release tag ${named} is unreadable`);
-  if (kind !== 'tag') return ineligibleRelease(explicit, `release tag ${named} is not annotated`);
-  const version = versionAt(repo, head);
-  if (!version) return releaseUnknown(`release manifest of ${named} is unreadable`);
-  if (named !== `v${version}`) return ineligibleRelease(explicit, `release tag ${named} differs from its manifest version ${version}`);
-  const reachable = releaseAncestor(repo, head, current);
-  if (reachable === null) return releaseUnknown(`release ancestry of ${named} is unreadable`);
-  if (!reachable) return ineligibleRelease(explicit, `release tag ${named} is not merged in HEAD`);
-  if (excludeHead && head === current) return { ok: true, candidate: null };
-  return { ok: true, candidate: { tag: named, head } };
-}
-
-/** Only one unsuperseded release ancestor proves a boundary; incomparable releases hold. */
-function nearestRelease(repo, candidates) {
-  if (!candidates.length) return releaseUnknown('no eligible annotated, manifest-bound release tag is merged in HEAD');
-  const nearest = [];
-  for (const candidate of candidates) {
-    const superseded = candidateSuperseded(repo, candidate, candidates);
-    if (superseded === null) return releaseUnknown('release ancestry between tags is unreadable');
-    if (!superseded) nearest.push(candidate);
-  }
-  if (nearest.length !== 1) return releaseUnknown(`release history is ambiguous: ${nearest.map((entry) => entry.tag).join(', ')}`);
-  return { ok: true, ...nearest[0] };
-}
-
-/** A release loses its boundary only to a proven descendant release, never to a date or version sort. */
-function candidateSuperseded(repo, candidate, candidates) {
-  for (const other of candidates) {
-    if (candidate.head === other.head) continue;
-    const older = releaseAncestor(repo, candidate.head, other.head);
-    if (older === null) return null;
-    if (older) return true;
-  }
-  return false;
-}
-
-/** Missing Git proof is distinct from a proven non-ancestor. */
-function releaseAncestor(repo, before, after) {
-  const result = mergeBaseQuery(['--is-ancestor', before, after], { cwd: repo });
-  if (result.status === 0) return true;
-  if (result.status === 1) return false;
-  return null;
-}
-
-/** The next releases named from the released versions, for a fix text: "v<wave> or v<line>". */
-const nextNamed = (released, version = null) => {
-  const next = nextReleases(released, version);
-  return next ? `v${next.wave} or v${next.line}` : 'v<new version>';
-};
-
-function versionFindings({ cwd, remoteCommit, version, released }) {
-  if (!remoteCommit) return [];
-  const remoteVersion = versionAt(cwd, remoteCommit);
-  if (remoteVersion === null) return [finding('RELEASE_REMOTE_HEAD_UNKNOWN', `the remote main head ${remoteCommit.slice(0, 9)} is not in this repository, so its version cannot be compared`, 'git fetch origin main')];
-  if (remoteVersion === version) return [finding('RELEASE_VERSION_UNCHANGED', `package.json version ${version} is the version the remote main already carries`, `set package.json version to the next release, move the CHANGELOG section to it, commit, then ${CUT_COMMAND(nextNamed(released, version))}`)];
-  return [];
-}
-
-/** The version must be the next release after the highest v* tag other than its own: a wave alpha.N.M is counted, never guessed. */
-function nextReleaseFindings({ version, released }) {
-  if (released === null) return [finding('RELEASE_VERSION_NOT_NEXT', 'the v* tags are unreadable, so the next release cannot be derived', 'git fetch --tags')];
-  const refusal = releaseVersionRefusal(version, released);
-  return refusal ? [finding('RELEASE_VERSION_NOT_NEXT', refusal, `set package.json version to the next release, move the CHANGELOG section to it, commit, then ${CUT_COMMAND(nextNamed(released.filter((entry) => entry !== version), version))}`)] : [];
-}
-
-function changelogFindings({ cwd, commit, version, tag }) {
-  const changelog = gitText(show, [`${commit}:CHANGELOG.md`], cwd);
-  if (changelog === null) return [finding('RELEASE_CHANGELOG_SECTION', 'CHANGELOG.md is not readable at the pushed commit', 'restore CHANGELOG.md')];
-  const notes = releaseNotesFindings({ tags: [tag], changelog });
-  if (notes.length) return notes.map((n) => finding('RELEASE_CHANGELOG_SECTION', n.message, 'finish the CHANGELOG section of the release (no in-preparation mark, no open marker), commit'));
-  if (!changelogSection(changelog, version).found || !DATED_HEADING(version).test(changelog)) return [finding('RELEASE_CHANGELOG_SECTION', `CHANGELOG.md has no dated heading "## [${version}] — YYYY-MM-DD"`, `date the heading of the ${version} section, commit`)];
-  return [];
-}
-
-function tagFindings({ cwd, commit, tag }) {
-  const kind = gitText(catFile, ['-t', `refs/tags/${tag}`], cwd)?.trim();
-  const target = gitText(revParseQuery, [`refs/tags/${tag}^{commit}`], cwd)?.trim();
-  if (kind === 'tag' && target === commit) return [];
-  return [finding('RELEASE_TAG_MISSING', `no annotated tag ${tag} points at ${commit.slice(0, 9)}`, CUT_COMMAND(tag))];
-}
-
-/** The finding of a record that claims the delegated mode without the checked-out config saying so (or without naming the delegated linux-parity row), else null. */
-function suiteModeFinding({ record, cwd, commit, tag }) {
-  if (record.suite !== 'ci') return null;
-  if (suiteModeOf(cwd) !== 'ci') return finding('RELEASE_SUITE_MODE', `the release record of ${commit.slice(0, 9)} says suite: ci, but this checkout's config.yaml release.suite is not ci: a record does not choose the mode`, `set release.suite: ci in config.yaml (the owner's choice), or ${CUT_COMMAND(tag)} under suite: local`);
-  if (!(record.delegated ?? []).some((row) => row?.name === 'linux-parity')) return finding('RELEASE_SUITE_MODE', `the suite: ci record of ${commit.slice(0, 9)} does not list linux-parity as delegated`, CUT_COMMAND(tag));
-  return null;
-}
-
-function receiptFindings({ cwd, commit, tag }) {
-  const record = readL4Record({ repo: cwd, head: commit, tag });
-  if (!record) return [finding('RELEASE_RECEIPT_MISSING', `no release record for exactly ${commit.slice(0, 9)} and ${tag}: the package clean-test, the scaffold e2e and the check did not run green on this commit`, CUT_COMMAND(tag))];
-  const mode = suiteModeFinding({ record, cwd, commit, tag });
-  if (mode) return [mode];
-  // A row reused from another commit (reusedFrom) counts: the cut reuses a row only when its input digest is identical (owner ruling speed-flow, 2026-10-25), and the record names the commit it came from.
-  const green = new Set((record.logs ?? []).filter((row) => row?.ok === true).map((row) => row.name));
-  const absent = RECEIPT_STEPS.filter((name) => !green.has(name));
-  return absent.length ? [finding('RELEASE_RECEIPT_INCOMPLETE', `the release record of ${commit.slice(0, 9)} has no green row for: ${absent.join(', ')}`, CUT_COMMAND(tag))] : [];
-}
-
-/**
- * The findings that keep `commit` from being a release commit of the repository at `cwd`: [{code, missing, fix}], [] when it is one.
- * `remoteCommit` is the remote main's head being replaced (null for a tag push or a first push); `tag` the release tag (default v<version>);
- * `needTag` / `needReceipt` are false only for the cut's early look, before it has created the tag and run the suite.
- */
-export function releaseFindings({ cwd, commit, remoteCommit = null, tag = null, needTag = true, needReceipt = true }) {
-  const version = versionAt(cwd, commit);
-  if (!version) return [finding('RELEASE_VERSION_UNREADABLE', `package.json at ${commit.slice(0, 9)} has no readable version`, 'restore package.json')];
-  const expected = `v${version}`;
-  const named = tag ?? expected;
-  if (named !== expected) return [finding('RELEASE_TAG_VERSION', `the tag ${named} is not v${version}, the version of ${commit.slice(0, 9)}`, `tag v${version}, or set package.json version to ${named.replace(/^v/, '')}`)];
-  const listed = gitText(gitTag, ['--list', 'v*'], cwd);
-  const released = listed === null ? null : taggedVersions(listed);
-  return [
-    ...versionFindings({ cwd, remoteCommit, version, released: released ?? [] }),
-    ...nextReleaseFindings({ version, released }),
-    ...changelogFindings({ cwd, commit, version, tag: named }),
-    ...(needTag ? tagFindings({ cwd, commit, tag: named }) : []),
-    ...(needReceipt ? receiptFindings({ cwd, commit, tag: named }) : []),
-  ];
-}

package/runtime/scripts/guards/release-record.mjs

@@ -1,58 +0,0 @@
-// release-record.mjs - the L4 record of a release: proof that the release cut ran the full suite for ONE commit. The git hooks
-// (the app and runtime pre-push, scripts/guards/git-hooks.mjs) let a push of main or a v* tag through only when HEAD carries
-// an annotated release tag AND this record exists for HEAD and names that tag, so a push that did not come out of the
-// release cut is refused without running a single test.
-//
-// The record lives in the git common dir (never in the tree: it is not tracked, never dirties a checkout and is shared by
-// every worktree of the repository): <git common dir>/starci-release/<head sha>.l4.json
-//   {schema: 'starci/l4-record@1', head, tag, suite: 'local'|'ci', delegated: [{name, why}], logs: [{name, ok, log, ms}], at}
-// `suite: ci` (the owner's choice, config.yaml release.suite) lists the rows CI judges as `delegated`, never as logs: a delegated row is not green, it did not run here.
-// The release cut (scripts/supervisor/release-cut.mjs, GOVERNANCE lane) calls writeL4Record after its full suite and check
-// passed and before the atomic push. Pure fs over the common dir path; the git call is injected (seam `commonDir`).
-import path from 'node:path';
-import { revParseQuery } from '../api/git/rev-parse-query.mjs';
-import { RELEASE_DEFAULTS } from '../../engine/release-config.mjs';
-import { proofFileOf, readProofFile, writeProofFile } from '../gates/commit-proof.mjs';
-
-const L4_SCHEMA = 'starci/l4-record@1';
-const RELEASE_TAG = /^v\d[\w.+-]*$/;
-const SHA = /^[0-9a-f]{40,64}$/;
-
-/** The absolute git common dir of `repo`, or null. */
-export function gitCommonDir(repo, { run = revParseQuery } = {}) {
-  const r = run(['--path-format=absolute', '--git-common-dir'], { cwd: repo });
-  const out = String(r.stdout ?? '').trim();
-  return r.status === 0 && out ? path.resolve(out) : null;
-}
-
-/** The record file of `head` under `commonDir`. */
-const l4RecordPath = ({ commonDir, head }) => proofFileOf({ commonDir, sha: head, kind: 'l4' });
-
-/**
- * Write the L4 record of `head` for release tag `tag`. {ok, file} or {ok:false, reason}: a head that is not a full sha, a tag
- * that is not v<version>, a failed suite step or an unreadable common dir writes nothing.
- */
-export function writeL4Record({ repo, head, tag, logs = [], suite = RELEASE_DEFAULTS.suite, delegated = [], candidate = null, commonDir = null, now = () => new Date(), run = revParseQuery } = {}) {
-  if (!SHA.test(String(head))) return { ok: false, reason: 'the head is not a full sha' };
-  if (!RELEASE_TAG.test(String(tag))) return { ok: false, reason: 'the tag is not a release tag v<version>' };
-  if (logs.some((step) => step?.ok !== true)) return { ok: false, reason: 'a suite step is not green' };
-  if (!['local', 'ci'].includes(suite)) return { ok: false, reason: 'the suite mode is local or ci' };
-  if (suite === 'ci' && !delegated.length) return { ok: false, reason: 'a suite: ci record lists the delegated rows' };
-  if (suite === 'local' && delegated.length) return { ok: false, reason: 'a suite: local record delegates nothing' };
-  const dir = commonDir ?? gitCommonDir(repo, { run });
-  if (!dir) return { ok: false, reason: 'the repository has no git common dir' };
-  const file = l4RecordPath({ commonDir: dir, head });
-  // candidate: the candidate CI verdict of this sha (scripts/supervisor/release-candidate.mjs), with the owner's override when the emergency path was used.
-  writeProofFile(file, { schema: L4_SCHEMA, head, tag, suite, delegated, logs, ...(candidate ? { candidate } : {}), at: now().toISOString() });
-  return { ok: true, file };
-}
-
-/** The L4 record of `head`, or null when there is none or it names another head, tag or schema. */
-export function readL4Record({ repo, head, tag = null, commonDir = null, run = revParseQuery } = {}) {
-  const dir = commonDir ?? gitCommonDir(repo, { run });
-  if (!dir) return null;
-  try {
-    const record = readProofFile(l4RecordPath({ commonDir: dir, head }));
-    return record?.schema === L4_SCHEMA && record.head === head && (tag === null || record.tag === tag) ? record : null;
-  } catch { return null; }
-}

package/runtime/scripts/guards/release-suite-mode.mjs

@@ -1,15 +0,0 @@
-// release-suite-mode.mjs - where the full suite of a release is judged, read from the checked-out owner config (config.yaml `release.suite`, engine/release-config.mjs):
-//   local   the release cut runs the root rows and the Linux parity container (the shipped default)
-//   ci      the owner's recorded choice (modules/kernel/owner-rulings.yaml release-suite-ci): the GitHub workflow runs the Linux parity after the push; the root rows still run locally
-// The mode is read from the checkout the cut or the hook runs in. A release record names the mode it was cut under, but a record never decides it: the gate accepts a record that says `ci` only
-// while this checkout's config says `ci` too. An owner file that is absent, unreadable or invalid reads as `local` (fail closed: the stricter mode).
-import { inspectOwnerConfig } from '../../engine/config.mjs';
-import { releaseSuiteMode } from '../../engine/release-config.mjs';
-
-export { SUITE_MODES } from '../../engine/release-config.mjs';
-
-/** The suite mode of the owner config under `root`: 'local' or 'ci'. */
-export function suiteModeOf(root) {
-  const { config, invalid, error } = inspectOwnerConfig(root);
-  return invalid || error ? releaseSuiteMode(null) : releaseSuiteMode(config);
-}

package/runtime/scripts/hfs/runtime-rules/release-notes.mjs

@@ -1,44 +0,0 @@
-// release-notes.mjs - RELEASE_NOTES (knowledge/hfs/rules.yaml, gate runtime): a release tag `v<version>` on HEAD has its CHANGELOG.md section
-// `## [<version>]` with no unfinished markers left in it and no `in preparation` mark. The tag message and the GitHub Release are that section
-// (docs/git-governance.md), so a tag cut over an unfinished section would publish a half-written release. Only the tags that point at HEAD are
-// judged: the release being cut. Pure apart from ctx.read and the git read (ctx.tagsAtHead overrides it).
-import { tag } from '../../api/git/tag.mjs';
-
-export const CODE = 'RELEASE_NOTES';
-const RELEASE_TAG = /^v\d[\w.+-]*$/;
-const UNFINISHED = /\b(?:TODO|PENDING|TBD)\b|in preparation/i;
-
-/** The CHANGELOG section of `version`: {found, body}. Pure. */
-export function changelogSection(changelog, version) {
-  const lines = String(changelog ?? '').split(/\r?\n/);
-  const start = lines.findIndex((line) => { const m = /^## \[([^\]]+)\]/.exec(line); return m && m[1] === version; });
-  if (start < 0) return { found: false, body: '' };
-  const end = lines.findIndex((line, i) => i > start && line.startsWith('## ['));
-  return { found: true, body: lines.slice(start, end < 0 ? undefined : end).join('\n') };
-}
-
-/** The RELEASE_NOTES findings of the release tags `tags` against `changelog` text. Pure. */
-export function releaseNotesFindings({ tags, changelog, file = 'CHANGELOG.md' }) {
-  const found = [];
-  for (const name of tags.filter((t) => RELEASE_TAG.test(t))) {
-    const section = changelogSection(changelog, name.slice(1));
-    if (!section.found) { found.push({ code: CODE, level: 'error', path: file, message: `${CODE} ${file}: the release tag ${name} has no \`## [${name.slice(1)}]\` section: write the release notes before the tag` }); continue; }
-    const unfinished = new RegExp(UNFINISHED.source, 'gi');
-    const marks = [...new Set([...section.body.matchAll(unfinished)].map(([mark]) => mark))];
-    if (marks.length) {
-      const listedMarks = marks.map((m) => `\`${m}\``).join(', ');
-      found.push({ code: CODE, level: 'error', path: file, message: `${CODE} ${file}: the section of ${name} still holds ${listedMarks}: finish it before the tag` });
-    }
-  }
-  return found;
-}
-
-/** RELEASE_NOTES over the checkout (ctx of scripts/hfs/runtime-check.mjs): the release tags at HEAD against the CHANGELOG at HEAD. */
-export function releaseNotesRepoFindings(ctx) {
-  let tags = ctx.tagsAtHead;
-  if (!tags) {
-    try { const r = tag(['--points-at', 'HEAD'], { dir: ctx.repoRoot }); tags = r.status === 0 ? String(r.stdout).split(/\r?\n/).map((t) => t.trim()).filter(Boolean) : []; } catch { tags = []; }
-  }
-  const changelog = ctx.read('CHANGELOG.md');
-  return tags.some((t) => RELEASE_TAG.test(t)) ? releaseNotesFindings({ tags, changelog }) : [];
-}