mjolnir-qa 6.0.0 → 6.1.0

package/CHANGELOG.md

@@ -9,6 +9,503 @@ Rule behavior changes (new rules, FP-rate changes against the corpus,
 severity changes) are first-class entries here — rule IDs are immutable
 once shipped, so this file is the record of what changed between versions.
 
+## [Unreleased]
+
+## [6.1.0] — 2026-10-28
+
+A minor release from the second half of the maintenance review. Most of it
+fixes behaviour that was wrong without saying so: report text that rendered as
+escaped markup, warnings that printed twice or not at all, reads that failed
+and were counted as successes, and release workflows that could publish when
+told not to. No verb, flag, Action input or MCP tool was added or removed.
+
+### Upgrade notes
+
+Two config checks are now strict and exit 10 with the entry named. Both
+configurations used to load and then silently do nothing, so a config that
+fails here was already not doing what it said.
+
+- `ignore[].expires` must be a calendar date, `YYYY-MM-DD`. A date-time
+  (`2026-09-01T00:00:00Z`) or an unpadded date (`2026-9-1`) left the
+  suppression inactive; write the date alone.
+- `plugins` must be an array of package names or `{ "package": "…" }`
+  objects. An object such as `{ "acme": {} }` loaded no plugin; write
+  `["acme"]`.
+
+### Fixed: the scheduled OSV scan runs again
+
+- **OSV-Scanner 2.7.0 removed `--skip-git`**, so the push and scheduled scans
+  failed before scanning. The flag is gone; pull-request scans never passed it.
+
+### Fixed: flag suggestions name only flags that exist
+
+- **`mjolnir scan` suggests only flags it accepts.** `--dry-run` and
+  `--version` were offered as "Did you mean" right after being rejected, and
+  ten accepted flags (`--staged`, `--blocking`, `--enable-plugins`, …) were
+  never suggested. A spec now reads the parser to hold the two lists together.
+- **Dead code removed:** the `ci install` line that shadowed the `ci`
+  subcommand table, an unreachable `ci --help` arm, an `existsSync` given a
+  glob it cannot expand, and two copies of the scan time-budget constants,
+  which the CLI and the MCP server now import from the pipeline that applies
+  them.
+
+### Fixed: CI and release workflows
+
+- **A stable release publishes to `latest` directly** (`release.yml`). It
+  published to `next` and relied on a token-based repair to move `latest`.
+- **A stable-release resume honours `dry_run` and requires
+  `STABLE_RELEASE_AUTHORIZED`.** It ignored both, so a resume dispatched with
+  the default `dry_run: true` published, including a dry run's artifact.
+- **The npm propagation wait polls `latest` as well as the version, for up to
+  ten minutes, and fails by name.** 6.0.1 took over five minutes to appear,
+  and the job timed out.
+- **The Action major-tag workflow moves `vN` to the newest stable `vN.x.y`.**
+  A manual dispatch tagged the head of the dispatching branch, and an older
+  patch tag could move `vN` backwards.
+- **The dogfood PR comment posts only on same-repository pull requests.** On
+  a fork or a manual dispatch the job failed with 403.
+- `github.base_ref` reaches the shell through `env:` rather than script
+  interpolation. The dead badge step and a duplicate `check-version` call are
+  gone, and the nightly stress run no longer starts at the same minute as
+  fuzz.
+- **`ci install` treats a Dependabot action-pin bump as not a
+  customisation.** Only the Mjölnir Action's SHA was ignored, so each bump of
+  `actions/*` made every workflow the previous release generated read as
+  hand-edited. The template's pins follow `mjolnir.yml` again.
+- Action pins bumped: `setup-node` 7.1.0, `upload-artifact` 7.0.2,
+  `download-artifact` 8.0.2, CodeQL 4.39.1, OSV-Scanner 2.7.0, Scorecard
+  2.5.0. The `web-tree-sitter` 0.25.10 bump is not taken: the
+  `package-smoke` spec holds its exact 0.25.6 pin.
+
+### Fixed: report rendering, config validation and swallowed errors
+
+- **Paths and code-like fixes in the PR comment, step summary and handoff are
+  real code spans.** Backslash escapes are literal inside a code span, so
+  `__snapshots__` rendered as `\_\_snapshots\_\_`, and a backtick in a path
+  closed the span early. The fence is now longer than any backtick run inside.
+- **The INCOMPLETE banner on a complete scan with no runtime evidence says
+  so**, and the quarantine coverage note is written out in words. The banner
+  used to name "an unreported reason".
+- **`ignore[].expires` must be a calendar date, `YYYY-MM-DD` (exit 10
+  otherwise).** A date-time or `2026-9-1` loaded, then left the suppression
+  silently inactive with no expired warning, and `2026-02-30` quietly meant
+  March 2. The expired warning now uses the same check as
+  `mjolnir scan --suppressions`.
+- **`plugins` must be an array of package names or `{ "package": … }`
+  objects (exit 10 otherwise).** An object, or an entry of another shape,
+  loaded cleanly and the loader ran nothing.
+- **Config warnings print once.** `scan` printed each one twice, and `fix`,
+  `ci verify` and `handover` dropped them. Those three now also send the
+  plugin gate notice to their own stderr.
+- **MCP `explain` finds the rule's fixture from a checkout**, defaulting to
+  `<cwd>/tests/fixtures` as `mjolnir explain` does. It never returned the
+  example finding the CLI prints.
+- **Runtime corroboration matches Windows report paths whose case differs
+  from the scan root** (`c:\repo` and `C:\Repo`). Each verdict missed its
+  finding.
+- **`--changed` marks an unreadable untracked file as fully changed** instead
+  of building a million-entry line set for it, which also dropped any finding
+  past line 1,000,000.
+- **Swallowed reads are counted:** an unreadable `pom.xml`, `build.gradle` or
+  `.csproj` (`java-manifest-unreadable`, `csharp-project-unreadable`) and an
+  unreadable rule source file in the detector fingerprint
+  (`rules-tree-file-unreadable`). The evidence store's audit fails on an
+  unreadable records directory instead of reporting an empty, intact store,
+  and `forensics` says why `FLAKY.md` could not be written.
+- **Census version majors sort numerically without the ambient locale**, and
+  the deterministic-ordering contract now also catches a `localeCompare`
+  whose locale argument is `undefined`.
+
+### Fixed: the stable release publishes the artifact it verified
+
+- **The first 6.0.1 publish run pushed `v6.0.1` and moved `v6`, then failed
+  before `npm publish`.** The verified artifact holds `release-artifact/` and
+  `release-assets/`, so `upload-artifact` keeps both directories, and the
+  publish job downloaded it into `release-artifact`, one level too deep:
+  `sha256sum: release-artifact/mjolnir-qa-6.0.1.tgz: No such file or
+directory`. The GitHub-release job and both resume jobs read the same wrong
+  layout. All four now download into the workspace root, and a spec reads the
+  upload paths and holds every consumer to them.
+- **The resumed GitHub release attaches the release-trust record**, which the
+  first-attempt release already required.
+- **Both publish jobs read no `.npmrc`**, as `release.yml` does, so the
+  placeholder token `setup-node` writes there cannot stand in for OIDC trusted
+  publishing.
+- **The SBOM checksum records a relative path**, like the tarball's. It
+  recorded the runner's absolute workspace path, and checked out only because
+  every job ran on the same path.
+
+## [6.0.1] — 2026-10-28
+
+A patch release. 6.0.0 shipped a GitHub Action whose report step calls a
+command the same release removed, so every job that used the Action failed,
+whatever the scan found. This release repairs that, along with the findings of
+the maintenance review that followed. Each change fixes behaviour that did not
+match its documentation or its contract. No verb, flag or Action input was
+added or removed.
+
+**Upgrading from 6.0.0:**
+
+- **The Action.** Pin `Sergey-Bar/Mjolnir@v6.0.1`, or `@v6`, which the stable
+  release workflow now moves to the newest 6.x release. The `version` input
+  defaults to `6.0.1`.
+- **`mjolnir ci install`.** Run `npx mjolnir-qa@6.0.1 ci install` again with
+  the same flags. It recognises the workflow 6.0.0 wrote and replaces its
+  broken steps; a workflow you edited still needs `--force`.
+- **Exit codes now match the contract.** `fix` and `explain --plan` return `2`
+  on a partial scan, `explain --evidence` returns `2` rather than `1` on an
+  incomplete report, an invalid config returns `10` rather than `20` on every
+  verb, and `ci verify` now honours `--blocking` and the E0 exemption. A
+  pipeline that keyed on the old codes can change colour.
+
+### Fixed: the stable release moves the Action's major tag
+
+- **`stable-release.yml` moved `v3` and nothing else.** The step that follows a
+  stable tag with the `vN` Action tag exited early for every major but 3, and a
+  spec required it to. Its tag push uses the job token, which starts no other
+  workflow, so `action-tags.yml` never ran either. That is why
+  `Sergey-Bar/Mjolnir@v6`, the pin the documentation recommends, does not
+  resolve. The step now derives the major from the tag, and leaves the major
+  where it is when a newer release on that line already exists.
+
+### Fixed: the release record
+
+- **5.1.0 was never published.** Its changelog section was cut and its stable
+  run reached the tag approval, which nobody gave, and 6.0.0 shipped first.
+  There is no `v5.1.0` tag and no 5.1.0 on npm. `docs/PUBLISHING.md` listed it
+  as published with links to a registry page and a GitHub release that do not
+  exist, and the roadmap called it shipped. Both now say what happened, and the
+  5.1.0 section of this file says so too.
+- **The run still waiting at that approval was cancelled.** If it had been
+  approved, it would have tagged 5.1.0 and published it as npm `latest`, over
+  6.0.0.
+- **Install commands that were left behind.** The site's guided proof and its
+  agent guide pinned 5.0.0, where the guided proof's `ci verify` does not
+  exist. `docs/guide/PERSONAS.md` pinned 6.0.0-rc.1, which was never
+  published, and sent readers to `stats` for per-rule FP rates; `stats` is the
+  fix-tracking ledger and the rates are `explain --list`. None of these files
+  is covered by `version:surface:sync`, so they now name 6.0.1 by hand.
+
+### Fixed: the `ci install` Action template pins an Action that works
+
+- **It pinned `4a588bc`, a pull-request branch commit that `main` never
+  contained.** That commit's `action.yml` installed `mjolnir-qa@latest`, called
+  the retired `trust-report` verb and wrote `mjolnir-trust-report.md`. The
+  template's publish job reads `mjolnir-comment.md`, so no workflow it
+  generated ever published a comment. It now pins the merge commit of the fix
+  above, on `main`.
+- **The template passes `version:`**, the published version the generating
+  package resolves, which is the npx template's pin. Omitting it ran the pinned
+  Action's own default: the stable published when that commit was made, which
+  can predate the formats its steps call.
+- **`ci install` printed the pin as a separately typed SHA with 41 hex
+  digits**, which names no commit. It now prints the template's own value.
+- Recognition ignores the `version:` value and still recognises 6.0.0's
+  template, which had no such line.
+
+### Fixed: the Action, `ci install` and the PR workflow render their reports again
+
+The v6 carve retired `summary` and `pr-comment` onto `scan --format
+github-summary` and `scan --format pr-comment`, and shipped only the half of
+each that scans. Every CI consumer renders the `--json` report its scan step
+saved. All of them kept calling the retired verbs, which exit 10:
+
+- **The Action.** Its report step runs by default, so v6.0.0 failed every
+  consumer's job, on a clean scan as well as a dirty one. Its summary step
+  failed too.
+- **`ci install --no-action`.** The generated summary and comment steps are
+  `continue-on-error`, so they failed without a sound: no annotations and no
+  PR comment, on any run.
+- **This repository's PR workflow**, which has posted "Mjölnir report
+  unavailable" on every pull request since 6.0.0.
+
+What changed:
+
+- **`scan --format github-summary <report.json>` and `scan --format pr-comment
+<report.json>` render a saved report**, as `site/reference/cli.md` already
+  said they did. They delegate to the retired verbs' own code, so the
+  contracts are the verbs': annotations on stdout inside GitHub Actions, the
+  summary written to `$GITHUB_STEP_SUMMARY`, and a render that never gates.
+  No verb or flag was added. A directory target still scans.
+- **The comment's commit is checked, not passed in.** It states the commit the
+  scan recorded only while the checkout is at that commit, and `unknown`
+  otherwise. The Action used to hand `--commit "$GITHUB_SHA"` to a verb that
+  printed whatever it was given. The live `--format pr-comment` render, which
+  always said `unknown`, now states the commit it scanned.
+- **The Action's summary step no longer pipes stdout into the summary**, which
+  copied every annotation command into it as text. Its `strict` input passes
+  `--include-warn` instead of the deprecated `--strict`, which printed a
+  deprecation notice into every consumer's log.
+- **`ci install` recognises the workflows 6.0.0 wrote**, so re-running it
+  replaces their broken steps without `--force`. Recognition required byte
+  equality with the current template, so the pinned version alone made every
+  earlier release's file read as hand-customised. Line endings, the pinned
+  version and the Action SHA are now ignored, and any other edit still refuses.
+- **The PR workflow's render step fails the job when the render fails**,
+  instead of `exit 0` under `continue-on-error`. Its fallback report for a
+  failed analysis now validates: it carried `"reason":"analysis-failed"`, which
+  the report validator rejects, so the one report written for that case could
+  never be rendered.
+- **A `--include-warn` scan's report loads again.** With the quarantine tier
+  running, nothing is withheld, and `rulesWithheld` said 0 while
+  `withheldRuleIds` still named the whole tier. The loader rejects a report
+  that contradicts itself, so the Action's `strict: true` would have failed
+  every render even with the verbs fixed, and no saved-report command could
+  read such a report. Lifecycle resolution also read those rules as withheld,
+  so a quarantine-tier finding that a strict scan had fixed resolved as
+  `INCONCLUSIVE(rule-withheld)`.
+
+The same defect in three more places, found by the widened gate below:
+
+- `release.yml` ran `release-trust`, retired onto `ci release-trust`, so that
+  step exits 10 when it runs. `stable-release.yml` already used `ci`.
+- `site/guide/forensics.md` told readers to run `npx mjolnir-qa@6.0.0
+forensics`, and the version-surface check required that line. Both now say
+  `explain --evidence`.
+- `docs/AI-DISCOVERY.md` pinned 5.0.0 and named the retired `baseline` and
+  `verify`. It now pins 6.0.0 with `--save-baseline` and `ci verify`, and
+  `site/public/llms.txt` says 6.0.0 too.
+
+Why nothing caught it:
+
+- **`check-cli-contract` matched only `mjolnir <verb>`.** CI steps launch the
+  CLI as `npx "$MJ_PACKAGE"`, `npx …/mjolnir-qa-<version>.tgz`, `npx
+mjolnir-qa@<version>` or `node dist/cli.mjs`, and it now reads all of them.
+  `docs/MIGRATION-3.0.0.md` joins the frozen-report list: its commands pin
+  3.0.0, where those verbs exist.
+- **Four specs asserted the command text**, and text is satisfied by a command
+  that cannot run. `tests/integrations/ci-render-commands.spec.ts` takes each
+  consumer's command from the file that ships it and runs it against the CLI,
+  and checks every scan argument the Action can pass.
+
+Still open:
+
+- The Action runs the published package, so Action users get this with the
+  next release, which moves the `version` default to it.
+- The floating `v6` Action tag was never created, because the tag job for
+  v6.0.0 was cancelled. The docs recommend `Sergey-Bar/Mjolnir@v6`, which does
+  not resolve yet.
+
+### Changed: every devDependency is an exact pin, and current
+
+`npm outdated` now lists only the two blocked upgrades below. Runtime
+`dependencies` and `peerDependencies` keep their ranges on purpose: they
+resolve inside every user's install, and an exact pin there would force
+duplicate copies and stop transitive security patches from reaching users.
+
+- **Pinned and updated.** Every devDependency in the root, the
+  `packages/playwright-reporter` workspace and `site/` is now an exact
+  version, taken to its latest release inside the existing major. This
+  covers Playwright 1.64.1 (and `playwright-core`, which two scripts import
+  directly, at the same version), Sentry 11.9.0, Vitest 5.0.5, ESLint
+  10.13.0, typescript-eslint 8.72.1, Prettier 3.9.10, tsdown 0.23.3 and
+  Lighthouse 13.6.0.
+- **commitlint 19 → 21.** The two majors break nothing here. 20 makes the
+  body line-length rule skip URL lines, and 21 drops Node 18 and 20. 21's
+  parser does read a body line that opens with `word: ` as a footer, which
+  `footer-leading-blank` then rejects. Across the last 150 commits on `main`
+  that rejected 2 that 19 accepted, and `.commitlintrc.cjs` now says how to
+  avoid it.
+- **vitepress 2.0.0-alpha.19 → alpha.21.** There is no stable 2.x, and 1.6.4
+  would be a downgrade. The site still renders 99 pages, its 44 tests and
+  doctor pass, and `home.data.ts` no longer trips the warning Vite prints for
+  its planned native config loader.
+- **The reporter's TypeScript 7 is gone.** Its build resolves the root
+  compiler, and building with and without the nested 7.0.2 gives
+  byte-identical output. Removing it ends what read as a split toolchain and
+  drops the compiler's 20 native binaries.
+- **Lockfile 589 → 461 entries.** Everything that left had no dependent in
+  the new tree, and the file still has the linux, darwin and win32 variants
+  every native package needs.
+- **`scripts/complete-lockfile.mjs` no longer resurrects removed packages.** It
+  restored every key the known-good lockfile had, so `siginfo` and
+  `stackback` sat in the committed lockfile with nothing depending on them.
+  It now restores only platform entries the tree still wants, and has tests.
+- **Dependabot.** Minor and patch updates come back as weekly grouped PRs:
+  runtime and tooling separately, plus the site, which had no entry and
+  received only security updates. 5.0.0 ignored them to cut noise, but with
+  every version locked an ignored update is never taken, which is how the
+  tree fell behind. Each blocked upgrade states when it was re-verified and a
+  review-by date.
+
+Still blocked, re-verified 2026-10-28, review by 2027-01-26:
+
+- `web-tree-sitter` 0.27.1 cannot load the Java or C# grammars of
+  `tree-sitter-wasms` 0.1.13, still its latest release, and 0.25.6 can.
+- TypeScript 7 has no JS API for ts-morph, and typescript-eslint 8.72.1 still
+  requires TypeScript below 6.1.
+
+Decided against, on inspection:
+
+- **Moving Lighthouse into `site/`.** The root deliberately holds Lighthouse,
+  axe-core and Playwright for `site:lighthouse` and `site:audit`, so the site
+  build that CI and Pages run installs only vitepress. Lighthouse's dependency
+  closure is 137 lockfile entries, which would be added to every site build.
+- **Dropping `axe-core`.** It looked unused only because `site:audit` loads
+  `axe.min.js` by path.
+
+### Removed: scripts and npm aliases that nothing ran
+
+Files under `scripts/`, 169 → 138. Tracked npm scripts, 147 → 140.
+`git show 05af655:<path>` recovers any deleted file.
+
+- **`scripts/archive/` (24 files).** One-shot fixture authors and
+  adjudicators from 2026-06 to 6.0. Their output is committed and none of
+  them ran; they were kept only as `HISTORY` entries in the orphan-script
+  list, and that list and the archive lint block are gone with them.
+- **Orphans:**
+  - `scripts/lib/omitted-measured.ts` and `scripts/lib/test001-probe.ts`:
+    scratch probes with zero references.
+  - `scripts/lib/coverage-exemption-ledger.ts`: a typed wrapper nothing
+    imported.
+  - `scripts/lib/candidate-decision.ts`: reachable only through an
+    extensionless import that resolved to the `.mjs` anyway. Its spec now
+    imports the `.mjs`, typed by the existing `.d.mts`.
+  - `scripts/compute-release.mjs` and its spec: release-bump logic whose
+    orphan entry said "reachable by nobody".
+  - `scripts/verify-remediation-isolation.mjs` (`verify:isolation`): a drill
+    hard-wired to a branch that no longer exists.
+  - `scripts/retired-external-evidence.ts` (`docs:external-evidence`): a
+    tombstone that exited 0 and checked nothing. The three documents that
+    named it now call it "the `docs:external-evidence` script (since
+    removed)".
+- **Aliases for suites `npm test` already runs:** `frontier:contracts`,
+  `test:integration`, `test:mcp:parity`, `test:release` and
+  `artifact:deterministic`. Three of their `docs/MANUAL-SCRIPTS.md` rows were
+  false: `test:mcp:parity` did not "need a live MCP client", `test:release`
+  needed no credentials, and `test:integration` was never "kept out of the
+  certify chain". All three ran in every `npm test`. The agent skills now name
+  the commands the aliases stood for.
+- **`docs/CI-STANDARD.md`** credited the compatibility lanes with
+  `npm run test:integration`. They run `npm test`, and the row now says so.
+
+Not done, on inspection: `check-promotion-throughput.mjs` keeps running under
+`tsx`, because it imports `src/commands/doctor.ts` and plain `node` cannot load
+it.
+
+### Removed: tracked files with no reader
+
+Six paths were tracked and read by nothing. Git history keeps all of them,
+and `repo-hygiene.spec.ts` now fails if any returns:
+
+- `enterprise-output/`: a 4.0.0 copy of `capability-manifest.json` with no reference.
+- `QA/`: one 2026-09-06 report that only linked to itself.
+- `archive/`: five exported stash patches. Their own README records each as
+  superseded, and they apply only at their old base commits.
+- `assets/readme/homepage-linkedin-aurora.gif`: 4.85 MB, referenced nowhere.
+- `.github/workflows/jekyll-gh-pages.yml`: a workflow whose only step was an
+  `echo`, plus its tier exemption.
+- `.claude/launch.json`: hard-coded another machine's worktree path; now gitignored.
+
+Also fixed:
+
+- **CHANGELOG.** A second `## [Unreleased]` block (about 1,000 lines of
+  6.0.0 working notes) sat below `[6.0.0]`, where the release script would
+  have swept it into the next version. It is now titled as the 6.0.0
+  development log, and a test asserts exactly one `[Unreleased]`, first.
+- **Stale references.** Removed a `package.json` `allowScripts` entry for
+  `@vitest/coverage-istanbul@5.0.1`, which the lockfile does not install.
+  Fixed the commit-msg hook's `.commitlintrc.json` reference (the file is
+  `.cjs`), the `.prettierignore` entries for retired M26 files, two Sonar
+  paths that do not exist, and the CodeRabbit workflow count.
+
+Kept on purpose: `PRODUCT-ENHANCEMENT-ANALYSIS.md` is a pinned redirect to
+its archive copy (`GAP-V6-007`, two specs), and `kilo.json` is the
+documented shared skills wiring (`docs/EXTERNAL-CONFIG.md`).
+
+### Fixed: the P0/P1 findings of the maintenance review (#732)
+
+Each has a regression test that failed before its commit.
+
+- **SARIF results pointed one directory too high.** `SRCROOT` had no trailing
+  `/` (SARIF 2.1.0 §3.14.14), so RFC 3986 resolution of `src/a.ts` against
+  `file:///repo` landed on `file:///src/a.ts` in every Code Scanning upload.
+- **Failing .NET tests disappeared from TRX runs.** A `UnitTestResult` body
+  over 4,000 characters (normal with StdOut and a stack trace) did not match,
+  so the failure was dropped and the run read greener than it was.
+- **Quadratic parsing of untrusted input.** JUnit `<failure>` tags without a
+  closer took 63 s for 2.2 MB, and `countTestDeclarations` took 152 s for
+  300,000 blank lines (it runs on every scanned file). Both are linear now.
+- **Exit codes.** `--save-baseline` no longer corrupts `--json` output, never
+  saves a partial scan, and reports a failed save as `2` (not `1`) after the
+  report. `fix` and `explain --plan` exit `2` on a partial scan. An invalid
+  config exits `10` on every verb, not `20`. `ci verify` gates new findings
+  through the same matrix as `scan`, so `--blocking` and the E0 exemption
+  apply. `explain --evidence` exits `2`, not `1`, on an incomplete report.
+- **MCP workspace root.** With `MJOLNIR_WORKSPACE_ROOT` set, a symlink or
+  junction inside the root that pointed outside it was accepted, and a child
+  named `..cache` was rejected. Both sides are now real paths. Without the
+  variable the read-only tools stay open, as before; the server header no
+  longer claims otherwise.
+- **Evidence store lock.** A live lock was bypassed after ~0.4 s: the write
+  ran unlocked and deleted the owner's lock. It now waits until the lock
+  could be stale and otherwise times out without running.
+- **Half-applied runtime corroboration.** A throw part-way through left some
+  findings at a runtime trust level (up to L5). Findings are restored and the
+  new `runtime-corroboration-failed` degradation is recorded.
+- **Action output.** `sarif_file` was nested under `findings:` in `action.yml`
+  and was always empty for consumers.
+
+Deferred, recorded on #732: the same `^\s*` pattern in three detectors also
+reports the wrong line (the blank line above the declaration); fixing it
+changes line attribution, so it ships with a `detectorRevision` bump and a
+corpus re-measure.
+
+### Fixed: `main` was red on every CI run since 2026-10-06
+
+- **Lockfile.** `package-lock.json` had been regenerated on one platform and
+  lost the linux/darwin `lightningcss` binaries, so `npm ci` failed on the
+  Node 24 job and on any fresh install. Restored with
+  `scripts/complete-lockfile.mjs`; `npm run lockfile:platforms` passes.
+- **README contracts.** The 6.0.0 README rewrite dropped the release-status
+  section, the `Status` heading, the documentation table, the roadmap link,
+  the census sentinels, the rule table, the WORTHINESS alt text and the
+  "a CI step fails" wording on exit `2` — every one pinned by a contract spec,
+  13 failures in all. They are back in the short layout. Two claims in the
+  rewrite were wrong and are corrected: `QA-CI-008` is "always-success step
+  masks failures", not "mutable Action refs", and the YAML example named
+  detections no rule makes (`--maxfail=0`, `--workers=1`, `@main`).
+- **README specs restored, not weakened.** The same rewrite had cut three
+  contract specs to match it: `readme-doctest` (which runs every README
+  command and checks the `explain QA-CI-001` transcript) became
+  `expect(true).toBe(true)`, `readme-samples` asserted the samples were
+  _absent_, and `readme-commands` grew a ten-verb exemption list. Those specs
+  were the only tests reaching several command paths, so function coverage
+  fell to 98.58 % against a 98.67 % ratchet floor. The specs are restored
+  verbatim from 6.0.0, and the command table, the explain transcript and the
+  two terminal samples come back as collapsed `<details>` blocks in a
+  Reference section, which keeps the page short. Functions are at 98.76 %;
+  the suite runs 87 more tests.
+- **Version surface.** `checkVersionSurfaceEnvelope` read an inline-code
+  install command (`` `npx mjolnir-qa@X` ``) as `` X` ``, so an unpublished
+  version written in backticks was never reported. The terminator set now
+  includes the backtick, matching the sync routine.
+- **Weekly SARIF scan.** `sarif-code-scanning.yml` scans `.` and had failed
+  every run since 2026-09-28 with exit `2`: `mjolnir.config.json` excluded
+  `tests/golden/**`, which covers the real spec `tests/golden/golden.spec.ts`,
+  so the scan honestly reported PARTIAL. The exclude is narrowed to the
+  fixture repo, `tests/golden/repo/**`, and `repo-hygiene.spec.ts` now asserts
+  the whole-repo scan is complete.
+- **Promotion ratchet.** `docs/RULE-PROMOTION-LEDGER.json` still bounded
+  `core` at `0` after 6.0.0 promoted `QA-PW-117` and `QA-JV-101`. The ratchet
+  passed only because a stale `[Unreleased]` block below the 6.0.0 heading
+  still carried that release's anti-creep exception marker; a new entry at the
+  top turned it red. The growth is ABSORBED (bound `0 → 2`, the same convention
+  as `docs/ANTI-CREEP-BASELINE.json`), and the licensed-growth arm, which the
+  committed tree no longer reaches, is now driven by a fixture pair. (This
+  entry spells the marker in lower case on purpose: the gate matches the
+  upper-case token anywhere in the top entry, so quoting it would license
+  growth that nobody declared.)
+- **Dependency advisories.** With `npm ci` failing, `npm run audit:ci` had
+  never been reached; it now ran and failed on `zod` (high, GHSA-mrhx-c7xc-m3w5,
+  via lighthouse → puppeteer-core → chromium-bidi) and `fast-uri` (moderate).
+  The site lockfile carried a `vite` advisory (high, GHSA-vfpm-58rq-9qcg). All
+  three are lockfile-only `npm audit fix` updates inside the declared ranges,
+  in dev tooling only — nothing in the published package changes.
+  `lockfile:platforms` passes for both lockfiles.
+- Regenerated: `docs/BLAST-RADIUS-AUDIT.md`, `docs/CARVE-MANIFEST.json`,
+  `candidate-trust-manifest.json`.
+
 ## [6.0.0] — 2026-10-04
 
 <!-- ANTI-CREEP-EXCEPTION: The launch set grew from 0 to 2 — QA-PW-117 and QA-JV-101 both earned core at n=35 with a 9.89% Wilson upper bound against the 10% ceiling, every row adjudicated by hand against a pinned corpus commit. Law 1 requires an equal-size removal or a recorded exception. Nothing was removed, deliberately: the quarantine population is what keeps unmeasured rules out of default scans, and promoting two rules by demoting two measured ones would have traded measured accuracy for a smaller number. The growth is arithmetic, not preference. -->
@@ -82,7 +579,12 @@ The check RAN and was RECORDED as unsatisfied. It was not treated as blocking
 because `vars.STABLE_RELEASE_AUTHORIZED` is `true`: a decision someone made and
 wrote down, not a check that passed.
 
-## [Unreleased]
+### Development log: 6.0.0-rc.1 → 6.0.0
+
+The working notes written between the release candidate and the cut. They
+sat under a second `## [Unreleased]` heading below this release, which
+`scripts/release-changelog.mjs` would have swept into the next version as if
+it were new work. They are history of 6.0.0 and are kept verbatim below.
 
 ### Two core rules, measured: QA-PW-117 and QA-JV-101 - `ANTI-CREEP-EXCEPTION`
 
@@ -1362,6 +1864,11 @@ and the replacement itself never warns.
 
 ## [5.1.0] — 2026-10-02
 
+> **Never published.** This section was cut on its release branch, but the
+> stable release run waited at the tag approval and was not approved, and 6.0.0
+> shipped first, carrying everything below. There is no `v5.1.0` tag and no
+> 5.1.0 on npm.
+
 ### Two subtractions declined, because the surface they would remove says something the replacement does not
 
 **`mjolnir capability`: delete the M0–M5 ladder, render the tier instead.** The