@stsepelin/checktrail 0.1.0-alpha.3 → 0.1.0-alpha.4

package/docs/GO-SCOPE.md

@@ -1,15 +1,16 @@
 # Go scope and Staticcheck
 
-`go.vet`, `go.test`, `go.test-race` and `go.staticcheck` first run native
-`go list -json ./...`. A passing result requires the union of native Go, cgo and
-internal/external test source files to exactly match the inventoried Go files.
+`go.vet`, `go.test`, `go.test-race`, `go.staticcheck` and `go.golangci-lint` first run
+native `go list -json ./...`. The race profile includes `-race` in both listing and
+test execution, so their build constraints agree. By default, a passing result
+requires the union of native Go, cgo and internal/external test source files to
+exactly match the inventoried Go files.
 Malformed package output, missing packages, duplicate/unexpected files and load
 errors prevent completeness. Real diagnostic/test failures retain their failure
 status even when scope is incomplete.
 
 Files excluded by build tags, OS/architecture suffixes or Go directory conventions
-remain unverified. The current policy has no build-matrix or per-file exception
-contract, so such projects are conservatively incomplete. This includes intentional
+remain unverified. Without an explicit scope policy, such projects are conservatively incomplete. This includes intentional
 `testdata` Go files if they are inventoried but not compiled. Do not treat that as
 a source defect or remove valid platform-specific code to obtain a passing run.
 
@@ -26,6 +27,70 @@ programs. Cross-module workspace builds need a separate explicit profile. Native
 compiler/analyzer caches may be used; test result caching remains disabled.
 Dependencies and toolchains must be prepared separately.
 
+## Explicit exclusions in the source checkout (unreleased)
+
+The source checkout adds `checktrail.go-scope.json` at each Go module root.
+Published alpha.3 does not support this policy yet. Opt in only after reviewing
+which files the intended native run leaves unverified:
+
+```json
+{
+  "schemaVersion": 1,
+  "excludedFiles": [
+    {
+      "path": "platform_windows.go",
+      "reason": "Windows implementation; validated separately on its target"
+    }
+  ]
+}
+```
+
+Paths are exact, case-sensitive, module-relative inventoried `.go` files. Globs,
+parent traversal, absolute paths, duplicate entries, blank reasons, unknown fields,
+missing files and symlink/directory policy files are rejected. An empty list keeps
+strict coverage. Planning only reads this file; native commands still require
+operator trust. A reason records the operator's statement, not proof of another run.
+The schema is [go-scope-policy.schema.json](../schemas/go-scope-policy.schema.json).
+
+For each selected native check, every declared file must appear in Go's
+`IgnoredGoFiles`, and every other inventoried Go file must appear exactly once in
+its selected source lists. An exemption becomes stale if its file disappears or
+becomes selected. New omissions, duplicate/contradictory native entries, malformed
+or interrupted output remain incomplete. A whole package excluded from `./...`,
+`testdata`, dot/underscore files and arbitrary unlisted files cannot be excused by
+this policy unless native package evidence accounts for them as ignored Go files.
+
+The same policy applies to vet, tests, race tests, Staticcheck and golangci-lint.
+A file ignored by ordinary tests may be selected under `-race`; one shared
+exemption then cannot pass both profiles. Do not exempt active code to suppress a
+diagnostic. Real diagnostics/test failures still fail. Every tested package still
+needs a passing test; exempted source supplies no test evidence. Formatting ignores
+the scope policy and checks every inventoried Go file.
+
+Detailed plans and reports retain the declarations as `goScope`; the original
+`scope` remains the complete inventory. A passing native check covers that scope
+minus its reconciled exemptions. Summary plans and reports expose
+`goExcludedFileCount` without paths or reasons. This is the number declared, even
+on an incomplete or unexecuted plan; it does not independently establish that the
+exemptions reconciled. Other-platform and excluded build-tag behavior is unverified.
+
+This policy does not introduce build-tag flags, cross-compilation, cross-target
+test execution or a build matrix. Use separately prepared native target runs for
+coverage outside the selected profile. Existing protected Go settings stay intact.
+
+## Known-case replay
+
+The [pinned public UUID replay](measurements/go-scope-policy-replay.json) uses the
+same upstream revision as the alpha.2 adoption exercise, with an unreleased packed
+CLI/library/MCP. Default scope remains inconclusive for vet/tests. Explicitly
+acknowledging `node_js.go` makes those selected native checks pass while retaining
+the skipped test and the existing formatting failure. An injected failing test
+still fails through all three surfaces. The JavaScript-target file is unverified;
+this is a known-case regression replay, not independent effectiveness evidence.
+The upstream tracked files and original policy were preserved; temporary scope
+policy and failing control were removed. The record identifies the tested tarball
+and runtime source hashes; adding this record changes later package bytes.
+
 ## Staticcheck
 
 Select `go.staticcheck` explicitly. It requires the installed `staticcheck`

package/docs/INSTALLATION.md

@@ -1,10 +1,11 @@
 # Install the preview
 
-The published preview is `0.1.0-alpha.2` on
+The published preview is `0.1.0-alpha.3` on
 [npm](https://www.npmjs.com/package/@stsepelin/checktrail).
-Use the exact version below. `next` points to alpha.2; `latest` still points to
+Use the exact version below. `next` points to alpha.3; `latest` still points to
 alpha.1 because npm rejected its removal. Neither tag implies a stable release.
-Alpha.2 includes [project setup and diagnosis](ONBOARDING.md).
+Alpha.3 includes [project setup and diagnosis](ONBOARDING.md) and the
+[TypeScript compatibility fix](TYPESCRIPT.md).
 
 Use Node.js 22 or newer on macOS or Linux. Windows execution is not supported.
 Install each project's compilers, linters and test runners separately; Checktrail
@@ -18,7 +19,7 @@ Skills install separately from the engine and MCP configuration.
 Install the exact version once:
 
 ```sh
-npm install --global --ignore-scripts @stsepelin/checktrail@0.1.0-alpha.2
+npm install --global --ignore-scripts @stsepelin/checktrail@0.1.0-alpha.3
 checktrail --version
 ```
 

package/docs/LANGUAGES.md

@@ -118,10 +118,15 @@ the optional skips allowed by a developer's general test suite.
 
 [Public adoption measurements](PUBLIC-ADOPTION.md) record alpha.2 on pinned
 JavaScript, TypeScript, Python, Go and PHP libraries. TypeScript 4.9.5 rejects
-the adapter's `--noCheck` option; this older version is not verified support.
+alpha.2's `--noCheck` option; that published artifact does not support this profile.
 Go platform exclusions remain inconclusive even when native tests exit zero.
 
-The unreleased [TypeScript compatibility fix](TYPESCRIPT.md) exercises plain
+The alpha.3 [TypeScript compatibility fix](TYPESCRIPT.md) exercises plain
 TypeScript 4.9.5 and 6.0.3 using native capability-aware arguments. Published
 alpha.2 retains the recorded older-compiler limitation; Vue and solution-build
 profiles retain their separately verified versions.
+
+The source checkout adds an unreleased [Go scope policy](GO-SCOPE.md) for exact,
+native-confirmed ignored files. It retains unverified exclusions in reports and
+does not claim a build matrix or add custom build-tag execution. Published alpha.3
+keeps the original strict exclusion behavior.

package/docs/MCP-COMPATIBILITY.md

@@ -46,6 +46,12 @@ extension handlers run. This was reproduced locally; `tasks/update` reaches its
 handler in the same probe. Upstream tracks the method-registry collision in
 [typescript-sdk#2598](https://github.com/modelcontextprotocol/typescript-sdk/issues/2598).
 
+Rechecked on 2026-09-21: npm's latest server/client SDK versions are still 2.0.0,
+the local probe still returns `-32601` for get/cancel and reaches update, and the
+[proposed upstream fix](https://github.com/modelcontextprotocol/typescript-sdk/pull/2599)
+remains open. The package retains its pinned SDK; no transport interception or
+protocol workaround is introduced.
+
 Run `npm run probe:mcp-tasks` from the source checkout to repeat the routing probe. Exit `2` means one or
 more handlers were unreachable; exit `0` means routing works. A routing success
 does not establish Tasks conformance. The probe is separate from the ordinary

package/docs/ONBOARDING.md

@@ -1,12 +1,13 @@
 # Project setup
 
-These commands are available in `0.1.0-alpha.2`. Follow the
+These commands are available since `0.1.0-alpha.2`. Follow the
 [installation guide](INSTALLATION.md), with Node.js 22+ on macOS/Linux.
 
 [Public adoption observations](PUBLIC-ADOPTION.md) show setup on real libraries,
 including nested documentation projects, workflow prerequisites and older compiler
 limitations. A narrowed policy can pass its selected checks while leaving other
-repository checks unverified.
+repository checks unverified. The [setup scope walkthrough](SETUP-SCOPES.md)
+shows how to inspect those boundaries and interpret an intentionally narrowed policy.
 
 ## Preview and create a policy
 

package/docs/PUBLIC-ADOPTION.md

@@ -55,13 +55,15 @@ operations were checked against the project tree.
 These are recorded adoption gaps, not fixes applied to the immutable alpha.2
 package. No new engine version is published by this exercise.
 
-## Unreleased follow-up
+## Alpha.3 follow-up
 
-The [compiler compatibility fix](TYPESCRIPT.md) now passes a known-case mitt replay
-with TypeScript 4.9.5 through a locally packed CLI, library and MCP. The observations
+The [compiler compatibility fix](TYPESCRIPT.md) is published in alpha.3. Its exact
+release artifact passes the known-case mitt replay with TypeScript 4.9.5 through
+the CLI, library and MCP; see [release verification](RELEASE.md). The observations
 above still describe published alpha.2; they are not replaced by the fixed source
-checkout's results. Workflow/documentation setup and Go platform coverage remain
-separate work.
+checkout's results. The [setup scope guide](SETUP-SCOPES.md) explains omitted workflows and documentation.
+An unreleased [Go scope policy](GO-SCOPE.md) now supports exact native-confirmed
+exclusions; a target matrix remains separate work.
 
 ## Reproduce
 

package/docs/RELEASE.md

@@ -1,42 +1,77 @@
-# Release preparation
+# Releases and publication
 
-The source is public at [stsepelin/checktrail](https://github.com/stsepelin/checktrail);
-`@stsepelin/checktrail@0.1.0-alpha.2` is published on npm. Its downloaded artifact
-matched the reviewed tarball with SHA-256
+The source is public at [stsepelin/checktrail](https://github.com/stsepelin/checktrail).
+The published preview is `@stsepelin/checktrail@0.1.0-alpha.3`.
+Its downloaded npm artifact and GitHub release asset match the reviewed SHA-256:
+
+```text
+261d10acbac14dcd5d74f4b248a390e5790f22461fecd597e29b8044aef2daeb
+```
+
+The [GitHub prerelease](https://github.com/stsepelin/checktrail/releases/tag/v0.1.0-alpha.3)
+and tag point to source commit `b0b447d5ea8973b3e427e179201a44b7baa1ca91` and include
+the same tarball plus `SHA256SUMS`. The [hosted release run](https://github.com/stsepelin/checktrail/actions/runs/35597877167)
+passed all jobs. The [MCP Registry entry](https://registry.modelcontextprotocol.io/v0.1/servers/io.github.stsepelin%2Fchecktrail/versions/0.1.0-alpha.3)
+is active and matches `server.json`, with execution disabled. The Registry omits
+`isSecret: false`, whose schema default is false.
+
+Fresh public-registry installation verified CLI/library validation, generated
+npx startup with fresh/warm caches, onboarding, and MCP pass/fail/incomplete
+results, retained reports and execution denial. The exact artifact also passed
+offline installation, alpha.2 → alpha.3 → alpha.2 upgrade/rollback, the known mitt
+TypeScript 4.9.5 replay, Claude Code health/discovery and Codex direct MCP calls.
+The [release record](measurements/release-alpha3.json) links these observations to
+the artifact; client profile limits remain in [CLIENTS.md](CLIENTS.md).
+
+## Alpha.4 candidate (unpublished)
+
+The checkout prepares `0.1.0-alpha.4` with optional exact Go file exclusions in
+`checktrail.go-scope.json`. Native package evidence must account for each declared
+exclusion. Active, absent or otherwise unaccounted-for declarations cannot pass.
+Go formatting continues to cover the full source inventory, and race-test package
+discovery now uses the same `-race` constraints as execution. See [GO-SCOPE.md](GO-SCOPE.md).
+
+Detailed plan/report schemas add an optional `goScope` declaration and summaries
+add an optional `goExcludedFileCount`. Consumers that validate with older strict
+schemas must update their schemas before accepting these fields. The policy is
+opt-in; existing projects retain strict scope accounting. Dependencies are unchanged.
+
+Alpha.3 does not understand the new sidecar policy. Rolling back keeps its bytes
+on disk but restores strict Go accounting, so a project relying on exclusions can
+become incomplete. Exclusions never establish validation of another platform or
+custom build-tag configuration. No cross-target execution is added.
+
+Candidate verification and commit approval precede publication. The installed MCP
+SDK routing probe was rechecked on 2026-09-21: standard Tasks remains unavailable;
+see [MCP-COMPATIBILITY.md](MCP-COMPATIBILITY.md). The published preview and artifact
+described above remain alpha.3 until a new release is explicitly authorized and verified.
+
+## Alpha.3 scope
+
+Alpha.3 fixes the plain TypeScript adapter's unsupported `--noCheck` argument on
+the exercised TypeScript 4.9.5 profile, retaining the TypeScript 6.0.3 override and
+native file accounting. Vue uses the same capability helper with its verified
+modern toolchain; solution-build remains gated to TypeScript 6.0.3. See
+[TYPESCRIPT.md](TYPESCRIPT.md). Dependencies and report/policy schemas did not change.
+
+The release targets Node.js 22 or newer on macOS and Linux. It does not add
+standard MCP Tasks or legacy Vue support. The historical alpha.2
+[adoption record](PUBLIC-ADOPTION.md) remains unchanged; its initial failures are
+not rewritten as alpha.3 successes. The immutable tarball contains preparation-time
+candidate documentation; current source documentation records verified publication.
+
+## Distribution tags and previous release
+
+`next` points to alpha.3. `latest` remains on alpha.1 because npm rejected its
+removal. Use exact versions; neither tag implies a stable release. Never republish
+an existing version. No credentials or automatic publishing workflow are stored here.
+
+The [alpha.2 prerelease](https://github.com/stsepelin/checktrail/releases/tag/v0.1.0-alpha.2)
+introduced [setup and diagnosis](ONBOARDING.md), from source commit `4ce8398`.
+Its reviewed and downloaded artifact has SHA-256
 `ffd0564f40a12a238a52fe25fe8c34fb36cf6f6480be7b6994bab82a3bd657fb`.
-Fresh registry installation, CLI/library validation, generated npx startup with
-fresh/warm caches and MCP pass/fail/incomplete results were verified. Alpha.2 adds
-[setup and diagnosis](ONBOARDING.md). The
-[MCP Registry entry](https://registry.modelcontextprotocol.io/v0.1/servers/io.github.stsepelin%2Fchecktrail/versions/0.1.0-alpha.2)
-is active and matches the alpha.2 release metadata, with execution disabled. The Registry omits
-`isSecret: false`, whose schema default is false. No credentials or automatic
-publishing workflow are stored here.
-The [GitHub prerelease](https://github.com/stsepelin/checktrail/releases/tag/v0.1.0-alpha.2)
-points to source commit `4ce8398` and includes the same tarball plus `SHA256SUMS`.
-The downloaded release asset was verified against the digest above.
-
-Publication is configured for npm's `next` tag. After alpha.1 publication, the
-registry assigned both `next` and `latest` to that preview; attempts to remove
-`latest` returned HTTP 400. Alpha.2 publication updated `next` while leaving
-`latest` on alpha.1. Cleanup remains unresolved; use exact versions, do not treat
-`latest` as evidence of a stable release, and never republish an existing version.
-
-## Alpha.3 candidate (unpublished)
-
-The source candidate is `0.1.0-alpha.3`. It fixes the plain TypeScript adapter's
-unsupported `--noCheck` argument on the exercised TypeScript 4.9.5 profile, while
-retaining the TypeScript 6.0.3 override and native file accounting. Vue uses the
-same capability helper with its existing verified modern toolchain; the separate
-solution-build profile remains gated to TypeScript 6.0.3. See [TYPESCRIPT.md](TYPESCRIPT.md).
-No dependencies or report/policy schemas change in this release preparation.
-The alpha.2 adoption record remains historical evidence.
-
-The candidate still targets Node.js 22 or newer on macOS and Linux. It does not
-add standard MCP Tasks or legacy Vue support. Registry metadata keeps execution
-disabled by default. Publication will use npm's `next` tag after release checks
-and hosted CI succeed; the alpha.2 publication evidence above does not verify
-this candidate. Exact artifact, client and upgrade/rollback evidence is retained
-outside the package allowlist until publication is verified.
+Its [hosted run](https://github.com/stsepelin/checktrail/actions/runs/35590670960)
+and fresh installation checks passed; its npm and Registry versions remain published.
 
 ## Prepared artifacts
 
@@ -54,8 +89,8 @@ outside the package allowlist until publication is verified.
   loads the installed metadata and verifies its actual startup command.
 - CI definitions cover the host suite and prepared native profiles. Local
   containers and package checks are evidence only for the environments actually
-  exercised. The [hosted run at 4ce8398](https://github.com/stsepelin/checktrail/actions/runs/35590670960)
-  passed all jobs for the alpha.2 release commit. The local Claude Code health/discovery and
+  exercised. The [hosted run at b0b447d](https://github.com/stsepelin/checktrail/actions/runs/35597877167)
+  passed all jobs for the alpha.3 release commit. The local Claude Code health/discovery and
   Codex direct app-server profiles have fresh-install evidence in `CLIENTS.md`.
 
 The metadata follows the official registry
@@ -91,7 +126,7 @@ After explicit approval and npm authentication for the `@stsepelin` scope, publi
 the approved file, not a newly packed working tree:
 
 ```sh
-npm publish /absolute/path/stsepelin-checktrail-0.1.0-alpha.3.tgz \
+npm publish /absolute/path/reviewed-new-version.tgz \
   --tag next --access public --ignore-scripts --registry=https://registry.npmjs.org
 ```
 

package/docs/SETUP-SCOPES.md

@@ -0,0 +1,107 @@
+# Choose and understand setup coverage
+
+A repository can contain a runnable library, a documentation project and CI
+workflows. Each can need different tools. `init` proposes checks; `doctor` reports
+static setup gaps; only a trusted `run` produces validation evidence.
+
+Use the [installation guide](INSTALLATION.md) and inspect before writing:
+
+```sh
+checktrail init --root "$PWD"
+checktrail plan --root "$PWD" --detailed
+checktrail doctor --root "$PWD" --detailed
+```
+
+A `needs-selection` or `attention-required` result exits `2`. Read its JSON before
+choosing checks. These inspection commands do not run project scripts or install
+dependencies. Detailed output includes paths and may include absolute diagnostic paths.
+
+## A library with documentation and workflows
+
+Consider this original, generic repository:
+
+```text
+package.json                    scripts.test is "node --test"
+sum.test.js                     one passing Node test
+.github/workflows/verify.yml    a GitHub Actions workflow
+docs/requirements.txt           documentation dependencies
+docs/conf.py                    documentation configuration, no tests
+```
+
+Discovery identifies JavaScript and infrastructure at `.`, and Python at `docs`.
+The directory name does not prove that it is documentation, nor that it can be
+ignored: the operator knows its purpose. Checktrail does not infer a documentation
+build command from a Python manifest.
+
+`init` returns `needs-selection` for the Python project and writes nothing, even
+though the Node test command is recognized. Supplying a check for `.` does not
+select it for nested projects. For example, this explicit preview covers all three
+discovered ecosystems:
+
+```sh
+checktrail init --root "$PWD" \
+  --check '.#javascript.node-test' \
+  --check '.#infrastructure.actionlint' \
+  --check 'docs#python.unittest'
+```
+
+It produces a policy preview, but the choice of `unittest` is not evidence of tests
+in `docs`. If that policy is created with `--write`, `doctor --detailed` reports
+`unavailable-check` for `python.unittest`: no candidate test files were discovered.
+Choosing a runner merely to resolve setup selection does not validate documentation.
+Use a separately supported check or the project's own documentation build; keep
+that work outside Checktrail's coverage claim when no applicable adapter exists.
+
+## Prepare workflow validation separately
+
+`infrastructure.actionlint` is static workflow analysis. It does not execute CI
+jobs or validate their shell bodies. It needs both the prepared native executable
+and `checktrail.actionlint.json` beside the workflow repository root:
+
+```json
+{
+  "schemaVersion": 1,
+  "runnerLabels": [],
+  "variables": []
+}
+```
+
+The empty arrays declare no extra runner labels or configuration variables. Review
+actual workflow requirements before adopting those values. See [ACTIONLINT.md](ACTIONLINT.md)
+for the supported tool version, configuration, dependency checks and limitations.
+Without this configuration, diagnosis reports `unavailable-check`; without an
+executable on the effective PATH it also reports `missing-executable`. Prepare the
+tool explicitly, then repeat diagnosis. A successful Node test cannot supply this
+workflow evidence.
+
+## Interpret an intentionally narrowed policy
+
+After reviewing the desired scope, an operator may explicitly maintain a
+language-only policy. For the example above, it is:
+
+```json
+{
+  "schemaVersion": 1,
+  "projects": [{ "path": ".", "checks": ["javascript.node-test"] }]
+}
+```
+
+Edit an existing policy deliberately; `init --write` preserves it and cannot
+replace it or narrow its checks through `--check` arguments. Do not discard
+existing overlays, packs, environment requirements or workspace dependencies.
+
+With the language-only policy, the commands have different meanings:
+
+| Command                                                   | Result for this example                                                                             | Coverage                                               |
+| --------------------------------------------------------- | --------------------------------------------------------------------------------------------------- | ------------------------------------------------------ |
+| `checktrail doctor --root "$PWD" --detailed`              | `attention-required`, exit `2`; `unselected-project` for infrastructure at `.` and Python at `docs` | Workflow and documentation-project checks are omitted. |
+| `checktrail run --root "$PWD" --trust-project --detailed` | `passed`, exit `0`, if the Node test passes                                                         | The selected Node test only.                           |
+
+These results are consistent: validation passed its selected check while diagnosis
+reported broader discovered scope left unselected. `doctor` does not assess every
+possible check within a selected ecosystem either; selecting Node tests does not
+claim linting, typing, browser behavior or documentation coverage.
+
+Keep omitted work visible in your review and CI requirements. The
+[public adoption report](PUBLIC-ADOPTION.md) records these distinctions on pinned
+public projects; its historical results are not a claim about your repository.

package/docs/STATUS.md

@@ -3,17 +3,29 @@
 This is an experimental foundation with public source at
 [stsepelin/checktrail](https://github.com/stsepelin/checktrail).
 Check the [installation guide](INSTALLATION.md) for package availability and setup.
-The `0.1.0-alpha.2` preview is published on npm and active in the MCP Registry.
-The [hosted run at 4ce8398](https://github.com/stsepelin/checktrail/actions/runs/35590670960)
+The `0.1.0-alpha.3` preview is published on npm and active in the MCP Registry.
+The [hosted run at b0b447d](https://github.com/stsepelin/checktrail/actions/runs/35597877167)
 passed all jobs. The published tarball matched the reviewed artifact; fresh
 registry installation, CLI/library validation, generated npx startup and MCP
 execution/trust behavior were verified. Earlier toolchain evidence remains in
 `NATIVE-CI.md`; release details and tag limitations are in `RELEASE.md`.
-The GitHub alpha.2 prerelease includes the verified artifact and checksum.
-[Public adoption](PUBLIC-ADOPTION.md) records the published package on five pinned
-libraries, including incomplete coverage and a TypeScript 4.9.5 incompatibility.
+The GitHub alpha.3 prerelease includes the verified artifact and checksum.
+[Public adoption](PUBLIC-ADOPTION.md) records alpha.2 on five pinned libraries, including incomplete
+coverage and the TypeScript 4.9.5 incompatibility fixed in alpha.3.
 
-## Alpha.3 candidate (unpublished)
+## Alpha.4 candidate (unpublished)
+
+The checkout version is `0.1.0-alpha.4`. Release verification is in progress;
+alpha.3 remains the published preview. No alpha.4 publication or hosted release
+verification is claimed.
+
+- [Go scope policy](GO-SCOPE.md): exact per-file declarations can acknowledge
+  native build-constraint exclusions. Go must confirm every exemption; stale
+  declarations and other omissions remain incomplete. Detailed reports retain
+  reasons and summaries show counts. Formatting still covers all source. Race
+  package listing now uses the same `-race` constraints as execution.
+
+## Alpha.3 release
 
 - [TypeScript compatibility](TYPESCRIPT.md): plain typechecking now passes the
   native 4.9.5 regression while retaining the 6.0.3 `noCheck` override and native
@@ -164,11 +176,10 @@ a general speedup/graph-completeness claim.
 
 ## Release preparation
 
-`server.json`, the npm package and the engine identify the unpublished
-`0.1.0-alpha.3` candidate. The currently published npm and Registry release is
-alpha.2. The candidate adds legacy TypeScript compatibility; publication requires
-its source commit to pass hosted CI and its exact tarball to pass release checks.
-Historical publication evidence and the candidate sequence are in `RELEASE.md`.
+`server.json`, the npm package and the engine identify the published
+`0.1.0-alpha.3` preview. Its source commit passed hosted CI, the published tarball
+matched the reviewed artifact, and fresh CLI/library/MCP installation checks passed.
+Publication evidence and the sequence for future releases are in `RELEASE.md`.
 
 ## Pinned pack distribution
 

package/docs/TYPESCRIPT.md

@@ -1,8 +1,8 @@
 # TypeScript compiler compatibility
 
 The source checkout's `javascript.typescript` profile now supports the exercised
-TypeScript 4.9.5 and 6.0.3 configurations. This fix is included in the
-**unpublished alpha.3 candidate**. Published alpha.2 still passes an option that
+TypeScript 4.9.5 and 6.0.3 configurations. This fix is published in
+**0.1.0-alpha.3**. Published alpha.2 still passes an option that
 TypeScript 4.9.5 rejects. The original
 [public adoption record](PUBLIC-ADOPTION.md) remains unchanged as release evidence.
 Other compiler versions require their own native verification.

package/docs/measurements/go-scope-policy-replay.json

@@ -0,0 +1,91 @@
+{
+  "scope": "Known-case replay of an unreleased local package; excludes the JavaScript target without validating it; not an independent holdout",
+  "upstreamCommit": "2d3c2a9cc518326daf99a383f07c4d3c44317e4d",
+  "tarballSha256": "08069a85dc7863394a88218a1670a2e00381c7e176a1ae4c987ce8496a4c3e19",
+  "platform": "darwin",
+  "arch": "arm64",
+  "node": "v26.8.1",
+  "observations": [
+    {
+      "phase": "strict",
+      "outcome": "failed",
+      "checks": [
+        {
+          "id": "go.format",
+          "status": "failed"
+        },
+        {
+          "id": "go.vet",
+          "status": "inconclusive"
+        },
+        {
+          "id": "go.test",
+          "status": "inconclusive"
+        }
+      ],
+      "mcpCounts": [0, 0, 0]
+    },
+    {
+      "phase": "declared",
+      "outcome": "failed",
+      "checks": [
+        {
+          "id": "go.format",
+          "status": "failed"
+        },
+        {
+          "id": "go.vet",
+          "status": "passed"
+        },
+        {
+          "id": "go.test",
+          "status": "passed",
+          "tests": {
+            "total": 213,
+            "passed": 212,
+            "failed": 0,
+            "skipped": 1
+          }
+        }
+      ],
+      "mcpCounts": [0, 1, 1]
+    },
+    {
+      "phase": "failing-test",
+      "outcome": "failed",
+      "checks": [
+        {
+          "id": "go.format",
+          "status": "failed"
+        },
+        {
+          "id": "go.vet",
+          "status": "passed"
+        },
+        {
+          "id": "go.test",
+          "status": "failed",
+          "tests": {
+            "total": 214,
+            "passed": 212,
+            "failed": 1,
+            "skipped": 1
+          }
+        }
+      ],
+      "mcpCounts": [0, 1, 1]
+    }
+  ],
+  "baseCommit": "bc0b95a511706475df97d1472b4724b36dbc2848",
+  "goVersion": "go version go1.27.1 darwin/arm64",
+  "sources": {
+    "src/go-scope-policy.ts": "be40a2fa681fd5c320e36ea4608a972cb369e045227e1e3fd539f915444287f3",
+    "src/go-scope.ts": "cc85c48962b91ab4b88977a78f8bddc62e866f8d863c265ffe1b1cfd523a4895",
+    "src/adapters.ts": "ba2dab60ac9ecf20d9843285b614d62b4853f06972e2e27946fe0f8de01c4a61",
+    "src/evidence.ts": "477a82d4b40cb3480fa9d5b6ab2a0d41c06685f275fda0abb061219eb2a7a086",
+    "src/output.ts": "6befd79c5cc095137edd5b11c6f29622ffa22f9d924ed64152a085abef7da891",
+    "src/schemas.ts": "e5add92fee2727e50222757703c8dd786b72c6ebf2b40d1fcad4864961805ee2",
+    "src/types.ts": "c30a5c65903342148a7a07c210d6c0b5231295bbf7b1d94944a29c070289587c"
+  },
+  "harnessSha256": "acd5dcad4cc8fce8818963f48714cc8af8139720f64779a2dbc79d6fb4866c3f"
+}