viafrei 1.3.12 → 1.3.16

package/CHANGELOG.md

@@ -3,6 +3,688 @@
 All notable changes to this package are documented here. The format follows Keep
 a Changelog and the versions follow Semantic Versioning.
 
+## [Unreleased]
+
+Nothing yet.
+
+## [1.3.16] - 2026-09-27
+
+**This is the release that delivers the licence corrections to the people the
+licences point at.** `NOTICE` is the file Apache-2.0 § 4(d) makes every downstream
+redistributor carry, and until this publish the corrected text existed only in the
+repository: the 1.3.15 tarball on the registry still carries the previous wording. So
+publishing is not a side effect of the correction, it **is** the correction — which
+is the whole reason this release exists, because nothing in `dist/` changes.
+
+The number matches the running service rather than counting the changes here.
+Production answered `initialize` with `1.3.16` when it was asked on 2026-09-27, and
+this package is the bridge to that server, so somebody comparing the two now reads
+one number instead of wondering which is behind.
+
+**No behaviour changes.** `dist/` is built rather than committed, and no file under
+`src/` has changed since the 1.3.15 tag — which is the evidence for the claim, since
+a diff of an untracked directory would be no evidence at all. So no flag, default or
+exit code moves. **Six** of the seven `files` entries do change —
+`README.md`, `LICENSE`, `NOTICE`, `SOURCES.md`, `CHANGELOG.md` and the new
+`API.md` — and the tarball goes from twenty paths to twenty-one. (Six *entries*,
+not six files: `dist` is a directory.)
+
+This paragraph has now been wrong twice, which is worth leaving on the record
+rather than tidying away. The first draft called these "the repository's own
+development scripts" and said the next tarball would differ in two files — true of
+the first change here, false once the licence work landed beside it. The second
+draft said **four** files and omitted `LICENSE` — and the commit that wrote that
+sentence is the same commit that changed `LICENSE`, so it was false at the moment
+it was written, in the paragraph written to correct a false count. The count moved
+once more at the cut, because `API.md` joined `files` in this release. Every
+version of it has been computed from `package.json`'s `files` intersected with
+`git diff --name-only v1.3.15..HEAD`, with the path count from `npm pack --json`,
+rather than counted by eye — which is the only way this sentence has ever been
+right.
+
+### Added
+
+- **A sweep that keeps the twenty-first call site from being written by accident**
+  (`scripts/tools.test.mjs`, `npm run test:tools`, and a step in CI). Eighteen
+  cases: what `resolveTool` accepts and refuses, that its directory list is
+  root-owned and not group- or other-writable (the property the module relies on,
+  rather than the list that is supposed to have it), that its contents cannot be
+  extended at runtime, that an `npm_execpath` which is absolute, real and readable
+  but not npm is refused, and then a sweep of all thirty-two source files,
+  walked recursively, for a spawn whose program is a bare quoted name.
+
+  It carries three preconditions, because a gate whose input is absent reports
+  success about what it never read: **every** source root must have contributed a
+  file and an unreadable root is a failure rather than an absence; the expression
+  must locate a program argument in a real file of this repository, proved by
+  putting a real call's program back to a literal in memory and requiring it to be
+  found; and it must go red on a planted bad call, with the fixtures assembled at
+  runtime so no literal in this file can satisfy its own sweep.
+
+  Both of the last two exist because the first drafts did not do what their own
+  comments claimed. The floor was a floor on the *sum*, and `scripts` and `test`
+  clear it between them — so `src/` could be deleted entirely and the run still
+  printed ok at 21 files. And the "it can see a call" precondition evaluated the
+  real expression only on the negative case; the positive half used a different,
+  simpler pattern and never asked the real one to read a file.
+
+  Proved the way a gate has to be: one real call site reverted to a bare name
+  turns the sweep red, one source root removed turns precondition 1 red, and the
+  files were restored byte-identical afterwards.
+
+- **[API.md](API.md): a reference for all 18 tools, generated rather than written.**
+  `catalogue.json` is what the production server answered when it was asked to
+  describe itself — `initialize` plus `tools/list`, `resources/list`,
+  `resources/templates/list` and `prompts/list`, captured on 2026-09-27 from
+  server `1.3.16`. `scripts/gen-api-doc.mjs` renders the document from it
+  (`npm run docs:api`), and `npm run check:docs` in CI fails if the two have
+  drifted. Every tool description in it is the server's own text, verbatim,
+  because that text is what an assistant reads when it decides which tool to
+  call — paraphrasing it would document a different server.
+
+  **No tool was invoked to produce the snapshot.** Listing is metadata; calling is
+  traffic, and one of the providers behind this service sets a floor on how often a
+  station may be queried, with the access itself at risk if it is exceeded. The
+  capture is therefore five list methods and nothing else.
+
+  **What generating it does and does not fix**, because README.md already argued
+  the opposite case and that argument was right. Drift between the document and the
+  snapshot is now impossible to keep — CI regenerates and compares. Drift between
+  the snapshot and the live server is not fixed by anything, because a capture is a
+  point in time. So API.md's own header says it is a dated snapshot, carries the
+  date, and names the running server as the source of truth — in that file and not
+  only in README.md. Both of them ship in the tarball, so that is not the reason;
+  the reason is that a qualification has to travel with the document it qualifies,
+  because somebody who opens the catalogue to look up a parameter has no occasion
+  to read the page beside it.
+
+  Two substitutions in the snapshot, both recorded in its own `$comment` rather
+  than left as silent differences from what the server sent: the 18 per-tool
+  `$schema` declarations are dropped as one constant repeated 18 times, and two
+  288-character date patterns are stored as their LENGTH. The second was forced by
+  the leak sweep and the interesting part is which side gave way — such a regex
+  spells its arithmetic as character classes of selected digits, which a digit-run
+  scanner cannot tell from a five-digit internal value. Both remedies on the
+  sweep's side would have been falsehoods: narrowing the scanner weakens it for
+  every file, and an allow-list entry would record that a character class is a
+  number this project publishes. So the text that cannot be scanned is not stored.
+  Nothing is hidden by it — the document already summarised a pattern over 60
+  characters by its length, and the server hands anyone the full expression.
+
+  One parameter is an object whose seven keys each carry their own bounds, and the
+  first draft rendered it as a dash in both the default and the constraints
+  column — the table's strongest claim broken on the row with the most to say. The
+  cause defeated the safety net as well: `properties` sat in the set of keywords
+  the renderer treats as handled, so the fallback that lists an unrecognised
+  keyword as a bare name never fired. The keyword was known; it was simply never
+  rendered.
+
+- **A self-test for the API-reference generator** (`scripts/gen-api-doc.test.mjs`,
+  `npm run test:docs`, and a step in CI). Its cases include the drift check refusing a
+  hand-edited file, never writing during `--check`, and naming `docs:api` when the
+  document is absent; eight snapshot mutations each refused with a named reason; a
+  malformed `required` rendering rather than throwing; a planted nested `default`
+  reaching the document; a union type in a table cell and in a bullet; an
+  array-of-scalar; and the reported line count agreeing with `wc -l`. The run prints
+  the total, which is the number to trust — this file has been wrong about counts
+  more than once, so it states none here.
+
+  It exists because the generator was the only script here making claims with nothing
+  checking them, and the same six mutants were being re-run by hand across three
+  review rounds — a check performed by remembering is not a check. It also earned
+  itself immediately, by catching two defects nothing else could:
+
+  The whitespace-flattening expression, rewritten to remove a super-linear
+  backtracking pattern, **was not equivalent to what it replaced.** It handled only
+  spaces and tabs beside the newline, so a `\r\n` line ending would have left a stray
+  carriage return in the document. API.md regenerated byte-identical, `--check`
+  passed, every gate was green — because this snapshot contains no CRLF. An output
+  comparison can only speak about the input it was given, so the test compares the two
+  **expressions** over every string up to length four drawn from a whitespace-heavy
+  alphabet, plus random longer ones, and asserts first that the alphabet can expose
+  the bug that shipped.
+
+  And a **union type was escaped twice**: `typeOf` joined with an already-escaped pipe
+  and the cell renderer escaped that pipe again, giving `string \\| null` — a literal
+  backslash, and a bare pipe left to end the table row early. In a bullet, which is not
+  a table, it produced a stray backslash instead. No tool in this snapshot declares a
+  union type, so neither was reachable and no comparison of documents could have found
+  it. Escaping now happens in one place, the one that knows it is writing a table cell.
+
+- **[SUPPORT.md](SUPPORT.md)**, so GitHub's issue chooser has somewhere to point:
+  where a question, a wrong answer and a security report each go, and what makes a
+  report actionable.
+
+- **README gains a Documentation table and five worked use cases** — a motorway
+  briefing, a broken commute including a station lift that is out, an EV weekend, a
+  dispatcher's morning brief, and a local-guide agent — each named by the question
+  it answers rather than by the tools it calls.
+
+### Changed
+
+- **One entry of 13 characters left the leak sweep's private-name list, under that
+  list's own rule 1.** The rule is stated in `scripts/rules.json`: an entry must not
+  be a substring of text this repository legitimately prints, because such an entry
+  can never be satisfied, and the only ways out are deleting it or narrowing the
+  scanner — which is strictly worse. There is no mechanical test for it; the sweep
+  going red *is* the test, and it went red. Declared narrowing: one spelling of 13
+  characters is no longer matched anywhere. The list's second rule is not engaged,
+  which decides that nothing else follows: the audit recorded in that file says
+  nothing on the list is from the class whose harm is confirming a guess —
+  credentials, tokens, session or contract identifiers, access-granting hostnames,
+  personal data — so there is no rotation and no rename here.
+
+  Recorded that way on purpose, and it is a change of practice rather than of
+  style. The two removals recorded under 0.0.9 described what the entries were
+  ABOUT, and taken together those descriptions narrowed the candidate space for a
+  live entry further than a hash does — the same caption failure the number
+  allow-list refuses on the facing page. The file now ends with the ruling: record
+  the rule, the lengths and the narrowing, never the subject. This is the first
+  entry written under it. The older wordings stay where they are, because editing
+  a published file does not unpublish it.
+
+  Coverage was asked of the change rather than asserted, since going from six
+  entries to five must not leave the sweep reporting PASS about what it no longer
+  looks for. The matcher was exercised per slot without needing any real name:
+  the list replaced by five planted names, each planted in text, five reds
+  required, and a negative control that stays clean. The sweep also prints the
+  list's size on every run, so the change is visible rather than silent, and the
+  gate self-test still refuses an emptied list. The window `minTokenLength` and
+  `maxTokenLength` is unchanged at 7 and 15: both are stored literals, neither is
+  derived from the list, and the removed entry sat at neither bound, so no
+  published number narrowed.
+
+- **`numbers.allowed` admits four values the SERVER publishes about itself** — two
+  inside tool descriptions and two as bounds in its own input schemas — under one
+  general rule written into that file rather than a caption each, because a caption
+  per value is the construction the list exists to avoid. It is safe to state in
+  general terms because the sweep already refuses an allowed number that occurs
+  nowhere in the tree, so an exemption cannot outlive its reason.
+
+- **Four statements about other people's licences were wrong, and they are the kind
+  a reader acts on.** Every one was verified against its own source before it was
+  changed, and each correction says that an earlier version had it wrong rather than
+  quietly reading better.
+  - **Share-alike reaches adaptations, not aggregations.** `SOURCES.md`, `NOTICE`
+    and `README.md` all said DELFI data must not be blended into a result under a
+    different licence. CC BY-SA 4.0 art. 3(b) is expressed only over Adapted
+    Material (art. 1(a)); showing licensed data beside another source's data is an
+    aggregation, and Creative Commons states in terms that the condition "applies
+    only for works considered adaptations under copyright law, not simply in
+    collections with other works". Worse than generous in two ways: art. 3(b)(3)
+    forbids imposing terms that restrict rights the licence grants, which is what
+    telling you an aggregation is forbidden does — and the rule as written condemned
+    this service, since a weather answer can name `["dwd","osm"]`.
+  - **The DELFI licence version was sourced to nothing.** Measured at both levels
+    on 2026-09-27: the GovData record for the realtime feed carries the unversioned
+    licence URI and an empty dataset-level licence, and the national access point's
+    own metadata reports the same unversioned term. The publisher's sibling feeds in
+    the same catalogue *are* versioned, so it states a version when it means one.
+    The page now names the family, shows the evidence, and says to treat the
+    share-alike as applying regardless — because the version decides what a
+    recipient may put on a derivative (art. 3(b)(1)), and 3.0 unported has no
+    express database-rights clause where 4.0 art. 4 does.
+  - **§ 7 DWD-Gesetz prescribes a duty, not a wording.** Fetched verbatim: the
+    section is headed *Quellenschutz*, requires distribution to be "nur unter
+    Angabe der Quelle zulässig" and sets no text — and its second sentence adds
+    that fuller protection under the Urheberrechtsgesetz "bleibt davon unberührt",
+    so attribution is the statute's minimum rather than the whole of what may be
+    owed. The three words come from the DWD's own guidance, which also permits the
+    logo form — so a reader told the statute fixes the characters might refuse a
+    form the publisher expressly allows.
+  - **`NOTICE` understated the ODbL duty, and it is the file that republishes
+    itself** (Apache-2.0 § 4(d) makes every downstream redistributor carry it). It
+    said "address results" where the predicate is which *table* answered — place
+    resolution falls through the gazetteer to the OSM tables, so any answer about a
+    place may be OSM-derived — and offered one extract where the § 4.6 offer covers
+    both addresses and points of interest.
+
+### Fixed
+
+- **Every external program these scripts run is now resolved to an absolute path
+  instead of being looked up on `$PATH`** (`scripts/tools.mjs`). `git`, `tar`,
+  `npm` and a `mkdir` were spawned by bare name, which means the environment — not
+  this repository — decided which program actually ran. That matters more here
+  than it would elsewhere: one of these scripts is the leak sweep that decides
+  whether a commit may be published, and another is the hygiene gate that reads
+  the tarball about to be uploaded to the registry. A gate whose implementation
+  the caller can substitute is not a gate. SonarCloud reported seven of the call
+  sites as `javascript:S4036` and the project's Security Rating on new code stood
+  at B because of them.
+  - `git` and `tar` now come from `/usr/bin` or `/bin` only. `/usr/local/bin` and
+    `/opt/homebrew/bin` are deliberately not searched: they are writable by the
+    logged-in user on a normal developer machine, so admitting them would
+    reinstate the substitution this change removes. A tool that is genuinely
+    elsewhere makes the scripts refuse and say where they looked, which is a
+    better failure than quietly running something else.
+  - `npm` is no longer treated as a program at all. It is a JavaScript file, so it
+    is run as `<absolute node> <absolute npm-cli.js>`; node's own path is
+    `process.execPath`, which nothing can substitute. `mkdir` was replaced by
+    `fs.mkdirSync` — no subprocess at all.
+  - **Twenty call sites changed, not the seven that were reported.** The other
+    thirteen are in the two self-tests, which SonarCloud does not analyse. Leaving
+    them would have left the rule true of the code and false of the repository,
+    and a rule with a quiet exemption is the one nobody remembers when adding the
+    next call. (Counted per file in the finished tree: `check-leaks.mjs` 2,
+    `check-tarball.mjs` 4, `npm-pack-json.mjs` 1 — Sonar's seven — then
+    `check-leaks.test.mjs` 3 and `check-tarball.test.mjs` 10. The first version of
+    this entry said nineteen, because it was counted with a single-line grep that
+    cannot see the one call whose program argument sits on its own line. A count
+    taken with the wrong instrument, in a release whose own subject is exactly
+    that.)
+
+- **And the repair for that duplicated it, which the quality gate caught before
+  the merge.** The precondition was *copied* from one self-test into the other —
+  eleven lines — and SonarCloud failed the pull request on **3.1% duplication on
+  new code** against a 3% limit, over exactly that block. Copying was the wrong
+  half of the right idea: the answer was always one implementation used twice.
+  It now lives in `scripts/fixture-root.mjs` as `missingFixtureImports()`, and each
+  self-test keeps its own refusal wording, because the two name different builders
+  and exit by different routes — a difference that is real rather than incidental.
+  Re-proved in each: dropping `tools.mjs` from a caller's file list makes that file
+  refuse by name, and each names its own builder.
+
+  **Concentrating the guarantee doubled its blast radius, so it got the assertion
+  it never had.** One function now stands behind every self-test that uses it, so a
+  silent `return []` disarms all of them at once and restores the wrong-reason pass
+  that started this thread — a sweep that cannot start, reporting no findings. The
+  number of those callers is deliberately not written here or in the module: it grew
+  again inside this release, and the sentence that said "both" went stale unnoticed
+  in five places while the corrected wording lived in one. On an ordinary run they
+  only ever exercise the complete-fixture path, so
+  until now the "missing" branch was proved solely by hand-mutating a file list:
+  four times by two people, and never again by anything. Two cases cover both
+  directions on a temporary directory, and they are mutation-proved — a planted
+  `return []` reddens one, and ignoring the directory argument reddens both.
+
+  Worth recording as the shape rather than the incident. A missing precondition was
+  fixed by adding one; adding it introduced a duplicate of it; the gate caught the
+  duplicate. Three links, and every one of them was found by something other than
+  the test suite, which was green at each step. The file count in this entry moved
+  from twenty-eight to twenty-nine because of it, then to thirty when this release
+  added a source file of its own, and then to **thirty-two** as it added the generator's
+  self-test and the module they share. The first two were re-derived from `npm run test:tools` rather than
+  incremented by hand. The third was not, and the review round found it stale. The
+  fourth was not typed either: it was read out of `npm run test:tools`'s own output
+  and the edit refused to write a number the command did not report. That was a
+  one-off script in a scratchpad, not something this repository carries — said plainly
+  because an earlier draft of this very sentence claimed a committed artefact that
+  does not exist. This paragraph has been wrong before, and that was the first time
+  it invented an artefact rather than a number.
+
+- **The leak sweep's own self-test had no precondition on the fixture it builds,
+  and reported a scope regression instead.** Both self-tests copy a named list of
+  files into a throwaway repository, and `tools.mjs` was missing from both lists.
+  `check-tarball.test.mjs` refused by name, which is what a precondition is for.
+  `check-leaks.test.mjs` had no such check: **measured**, three of its four cases
+  failed with messages about scope — "expected a clean exit, got 1", "the run does
+  not say which scope it used" — because every invocation died of
+  `ERR_MODULE_NOT_FOUND`, and the fourth case *passed*, since a sweep that cannot
+  start also cannot report a finding. That is worse than a red suite: it sends the
+  next reader after the ruleset instead of after a missing file. It now refuses by
+  name, proved by dropping the file again.
+
+- **`npm_execpath` was trusted if it was merely absolute and ended in `.js`** —
+  which reversed this change's own thesis for npm. The decider had moved from
+  `$PATH` to an environment variable, and the local review demonstrated it by
+  pointing the variable at a hand-written file, which the tarball gate would then
+  have run as npm. The value must now also be *shaped* like npm's CLI, ending in
+  `node_modules/npm/bin/npm-cli.js`. What that does not claim, because a security
+  note that overstates its reach is worse than none: anyone who can both set your
+  environment and create a file at that path is still obeyed — and anyone able to
+  do both can usually substitute node itself. The narrowing is from "any writable
+  path" to "a path that looks like a real npm installation": **it stops accidents,
+  not an attacker**, and it is not a privilege barrier. An earlier draft said
+  "stray, mistaken or opportunistic", which the sentence after it contradicted — an
+  opportunistic value costs one `mkdir -p`.
+
+- **`npmCliPath()` refused to find npm on a Homebrew Mac.** Its first draft knew
+  only the `../lib/node_modules/…` layout, which is what the GitHub-hosted runner
+  and nvm use — so it passed in CI and failed on a developer's machine, where
+  Homebrew puts npm under `../libexec/lib/node_modules/…`. Both layouts are tried
+  now, each from the given path and again through `realpathSync`, since a node
+  reached by a symlink resolves its siblings from the real location. Caught by the
+  new self-test on the first run, which is the argument for having written it.
+
+- **The false-positive fix opened a worse false negative, and the second review
+  round caught it.** Excluding `RE.exec('git')` by putting a `(?<!\.)` lookbehind
+  in front of the whole alternation also excluded every *member-expression* spawn —
+  `child_process.execFileSync('git', …)`, `cp.execSync('git status')` — which is a
+  shape SonarJS does report and a contributor can write without doing anything
+  unusual. So a fix aimed at a shape nothing writes blinded the sweep to a shape
+  people do. The lookbehind now applies to the bare name `exec` alone, measured
+  over twelve shapes: the all-names form was wrong on four of them, this one on
+  none. The one trade it still makes — `obj.exec('git')`, a method named `exec` on
+  something that is not a regular expression — is in the limits list, because no
+  expression can tell it from `RE.exec('git')` without a parser. Both directions
+  are pinned in the preconditions now rather than left incidental, since a review
+  round changed this behaviour by accident once already.
+
+  Two smaller things fell out of it. The comment describing the lookbehind said
+  `(?!\.)` where the code says `(?<!\.)` — a look*ahead* there would match nothing
+  useful, so it was the one comment in the file that would mislead somebody
+  "fixing" the code to match it. And the worked examples added to document the
+  twelve shapes turned the file red, because an example of a bare call, spelled as
+  one, *is* a bare call as far as the sweep is concerned; they carry no quote
+  characters now. The sweep catching its own documentation is the least ambiguous
+  evidence available that the member-expression form works.
+
+- **Two documents that enumerate the gates had gone stale in the same commit that
+  added one.** `CONTRIBUTING.md` said "four more checks exist, and CI runs all
+  four" — five now, and the new one was missing from the block a contributor is
+  sent to, which also made the next paragraph's "a fifth command" read as a
+  contradiction. The pull-request checklist named two gates as "the
+  public-repository gates", so a contributor following it would not have run the
+  sweep that exists to catch exactly the call they might be adding.
+
+## [1.3.15] - 2026-09-27
+
+The first release with features in it since the bridge got code. Three
+capabilities, and the documentation caught up with a service that had quietly
+grown past it.
+
+**If you only use `npx -y viafrei`, nothing changes and nothing breaks.** No flag
+was removed, no default moved, no exit code changed meaning. The three additions
+are opt-in or invisible.
+
+### Added
+
+- **A contributor surface: `CODE_OF_CONDUCT.md`, three issue templates with a
+  chooser, and a pull request template.** The Code of Conduct is Contributor
+  Covenant 2.1, and a report with no GitHub account goes to the Impressum e-mail
+  rather than to the **postal** address printed there — that address is still a
+  visible placeholder, and a reporting route has to be one that works. The three
+  forms are a bug, an idea, and the one report this service cannot make about
+  itself: a tool answered and the answer was useless. Beside them the chooser
+  carries the three routes that are not forms — the private security advisory,
+  Discussions, and `SOURCES.md` for a data or licence question. None of these
+  existed in 1.3.12.
+- **`VIAFREI_MCP_HEADER` sets HTTP headers from the environment.** Many MCP
+  clients can only give a command an `env` block, never arguments, which left
+  those users no way to send a header at all. It takes the same `Name: value`
+  syntax as `--header`, refuses the same transport-owned names, and separates
+  several headers with a **newline**, which can never appear in a header name or
+  value, so nothing you might need to send is unrepresentable - a comma, a
+  semicolon and a space all occur inside real header values. A `--header` of the
+  same name wins; one of a different name is added alongside. An error names
+  `VIAFREI_MCP_HEADER`, not the flag you did not type.
+- **`Retry-After` is honoured on the single retry, with a cap.** Both legal forms
+  are read - a number of seconds and an HTTP-date - and a value that cannot be
+  parsed, or names a moment already past, falls back to the fixed delay instead
+  of throwing. **The cap is the per-request timeout**: a server answering
+  `Retry-After: 3600` does not make `npx viafrei` sit silently for an hour; the
+  retry is abandoned and the ordinary one-line failure, which already names the
+  URL and the status, stands. `429` is retried now that the delay it asks for is
+  respected - and **only when the header gives a usable delay**. A 429 carrying
+  nothing readable is not retried at all, because the only thing left would be the
+  fixed delay, and a fixed delay is what makes a rate limit worse. For the same
+  reason a *thrown* 429 is still not retryable: there the header is gone. A 503 in
+  the same state IS retried, and a test pins the difference so it cannot be
+  flattened by accident.
+- **A pathless `--url` that gets a 404 is told where the endpoint usually is.**
+  `--url http://127.0.0.1:3000` now fails with `... HTTP 404 Not Found - the URL
+  has no path; the MCP endpoint is usually /mcp`. **It is a hint and not a
+  rewrite**: quietly appending the path would send the request somewhere nobody
+  asked for and hide a different mistake later. The hint appears only when the
+  path is empty or `/`, never on another status, and a URL that will not parse
+  skips the hint rather than making the failure message itself throw.
+
+### Changed
+
+- **The README leads with how to connect, and says why to build on it.** The page
+  opened by explaining that you probably do not need this package, which is true
+  and was the first thing a developer read. The three transports now come first,
+  with the address to use, and a section sets out what the service is actually
+  offering: one protocol in place of twenty-one sources from sixteen publishers,
+  the licence obligations travelling with each answer, machine-readable failures,
+  and answers in the language of the question.
+- **The tool count was wrong and is now a capability table.** The page said
+  thirteen tools; the server registers **eighteen**. The five geocoding tools had
+  shipped on the platform before the previous bridge release was even cut. The
+  table groups tools by the question they answer, which is stable, and the page
+  still refuses to paste the catalogue itself - a published tarball cannot be
+  corrected, so `tools/list` on the running server remains the only source of
+  truth.
+- **The one completeness claim the new table introduced was measured before it
+  shipped.** The Places row says "nationwide, all sixteen Länder", which no tool
+  reports and which would rot at a partial import - the same objection that removed
+  the two address figures under **Fixed** ("Two address figures nobody could check
+  are gone"). It was kept because it was measured
+  rather than inferred, and it now carries the date: on 2026-09-27 the service's own
+  per-Land verdict - which reads both OSM tables, names any missing Land and exits
+  non-zero on one - reported all sixteen imported with every row scoped to its Land,
+  and two address lookups in the two Länder least likely to have been staged —
+  Mecklenburg-Vorpommern and Saarland, asked in Rostock and Saarbrücken — both
+  answered through the public endpoint with `osm` in `_meta.sources`. `SOURCES.md` carries the measurement, and one caveat that nearly
+  misled it: a single address that does not resolve says nothing about its Land.
+- **The README now says that a slow call may be a retried call.** A `429`, `502`,
+  `503` or `504` is tried again **once** after the delay the server asked for, as
+  is a connection that failed outright; a `429` with no usable `Retry-After`, and
+  any delay longer than the per-request timeout, are not retried at all. The page
+  also now says what that timeout does and does not bound, because the first draft
+  of the paragraph got it wrong in the direction a user would act on: it is attached
+  per HTTP request, so the second attempt gets a fresh one and so does each hop of a
+  same-origin redirect, and **no setting here caps the whole call**. Two drafts of
+  that one clause were wrong, in the same direction and in the sentence a reader
+  would act on: the first said a retried call "can never exceed the timeout you gave
+  it", and the correction that replaced it said to halve the timeout for a hard
+  ceiling — but two attempts plus a delay that may itself be as long as the timeout
+  is three times it, not two, and more again if the endpoint redirects. Both were
+  caught in review rather than published, which is the argument for rounds that cost
+  nothing, and the second is the sharper lesson: a corrected number is still a
+  number, and nothing was reading it. That behaviour shipped earlier and the
+  page did not mention it, so a user watching a call take longer than expected had
+  nothing to read. Nothing about the behaviour changed in this release.
+- **Both examples on the page are now captured output rather than plausible
+  output.** The departures block is a real answer from `mcp.viafrei.de` on
+  2026-09-27, and the failure line is copied from a run.
+- **The badge hosts are admitted to the leak ruleset as their own group, with
+  their one cost written down.** A shields.io badge is the only entry on that
+  allow-list that causes a request from somebody else's browser, so the ruleset
+  now says that, says the admission test, and says it is the reason to refuse the
+  next image host rather than to admit it by precedent. The list itself stays
+  sorted alphabetically rather than grouped, and the ruleset now says why: one flat
+  sorted list is what makes a duplicate, or a near-miss spelling of a host already
+  on it, visible at a glance.
+- **`numbers.allowed` is back to six entries, and the two rules governing it are
+  separated.** A seventh was added during this release to accommodate two bare
+  millisecond literals, then removed once both were written `1_000`: an entry that
+  covers nothing in the tree is a caption pointing at a value, which is the one
+  thing the inverse construction exists to avoid. (The entry is not named here,
+  because naming it would put the bare form back in the tree and the sweep would
+  be right to say so — it said so about the first draft of this very bullet.) The ruleset now distinguishes **the rule** (an
+  entry occurs in the tree and is not an internal value — which `3600` and `9110`,
+  both prose in a comment, satisfy) from **the preference** (write a numeric
+  separator where one is available, so the literal never reaches the list at all).
+  Citing the second as if it were the first is what made the list look arbitrary
+  for one review round.
+- **Two `allowedHosts` entries covering nothing are gone.** Bare `shields.io` and
+  bare `contributor-covenant.org` sat beside `img.shields.io` and
+  `www.contributor-covenant.org`, and no URL in the tree uses either; the bare
+  spellings occur only in prose about them, and the host extractor reads a
+  scheme-prefixed URL and nothing else. That is the same shape as the
+  allow-list number this release removed: an entry that permits nothing is a
+  permission nobody can audit. The history-residue block is also back to one line
+  per entry; reformatting it to five four-line objects changed no meaning and cost
+  twenty-five lines of diff in the file a reviewer reads hardest.
+- **A re-wrap put a private name into a public file, and the sweep caught it —
+  which is also a demonstration of the one limit it declares loudest.** The gate
+  reads **one line at a time**, and says so in its own limits list. A paragraph
+  of this release's prose was re-flowed, and prose that had passed every earlier
+  run matched a live entry the moment the wrapping changed. Nothing was ever
+  published: it reached a working tree and no further. What the offending text
+  was is deliberately not recorded — `scripts/rules.json` says to record the
+  rule, the lengths and the narrowing and never the subject, because a
+  description narrows the candidate space for a live entry further than the hash
+  alone does, and this file cannot be unpublished. The lesson is the gate's, not
+  the prose's — a line-oriented scanner's verdict depends on where the wrapping
+  falls, so its PASS is about this wrapping and not about this text, and a
+  re-wrap is a change the sweep has to see again.
+
+### Fixed
+
+- **`package-lock.json` still said 1.3.12 while `package.json` said 1.3.15, and
+  nothing in this repository would have noticed.** Found in the last pre-push check
+  of the release, by reading the two files rather than the diff: seven review rounds
+  had confirmed the lockfile was *unchanged*, which is true and is not the same as
+  correct. The publish workflow asserts that the TAG and `package.json` agree and
+  says so in its own step name; no gate compares the lockfile to either, and the
+  lockfile is not in the published tarball, so the only thing that reads it is the
+  `npm ci` the release build runs. It is now 1.3.15, regenerated with
+  `--package-lock-only` so the change is exactly the two version fields and no
+  dependency moved. **The missing gate is deliberately not added here**: it belongs
+  in `publish.yml`, and an untested edit to the workflow that publishes, inside the
+  commit it publishes from, is the wrong trade a day before the tag — it is filed
+  for the next release and rehearsed through the `workflow_dispatch` dry run, beside
+  the two other workflow items this release also deferred.
+- **SOURCES.md described a service three capabilities smaller than the one that
+  is running.** Address lookup, lift and escalator status, and public-transport
+  realtime were all documented as not answering on the public service. All three
+  answer, and each was re-confirmed by a call whose result named the source. The
+  BKG administrative gazetteer was listed as merely licence-read and is in fact
+  named by answers from five different tools. Every status in the catalogue was
+  re-measured on 2026-09-27 by calling **fifteen of the server's sixteen
+  read-only tools** - every one except `find_cheapest_fuel` - once each and
+  reading `_meta.sources`. That one exception is **fuel**, which is deliberately not
+  re-measured because MTS-K sets a per-station floor and its terms make needless
+  querying a risk to the access itself. That row is labelled `not re-measured`
+  rather than dressed up as today's measurement.
+- **SOURCES.md contradicted itself, and one of the contradictions was a licence
+  statement.** The table was re-measured; three paragraphs beneath it were not,
+  and they still told a reader that address lookup, facility status and
+  public-transport realtime do not answer. The worst of them sat in the ODbL
+  obligations section and said a share-alike obligation *"binds nobody using that
+  service right now"* - measurably false, on the one page whose job is to state
+  obligations, inside a tarball that cannot be corrected after publication. Every
+  such paragraph now states today's measurement and says which of the two
+  versions a reader saw. The status legend lost the value no row carries any more,
+  rather than leaving a status somebody could still be relying on.
+- **The README promised rail disruptions "on a line or at a stop".** The server
+  declares the opposite in its own tool description and in `viafrei://coverage`:
+  it never answers whether a named line, trip or stop is on time. The row now says
+  region-wide and says never one line or stop.
+- **Two address figures nobody could check are gone.** The Places row quoted a
+  count of addresses and POIs that no tool reports and that would rot at the next
+  import - the exact argument the paragraph below it makes against pasting a
+  catalogue.
+- **The departures example names both of its edits.** It said the only edit was
+  shortening two URIs; five of the ten departures were dropped as well.
+- **The OSM attribution line printed in `SOURCES.md` was not the line the server
+  emits.** The code fence said `Geokodierung: …`; no answer has carried that prefix
+  since `find_poi` and `find_address` began returning an OSM row **as** the answer
+  — a name, a brand, a door — rather than only a coordinate resolved from one. The
+  correct line is `OSM-Standortdaten: © OpenStreetMap-Mitwirkende, ODbL 1.0`, and
+  1.3.12 carried it nowhere: the page was wrong about the one string it exists to
+  publish, inside a tarball that cannot be corrected. A draft of this release then
+  printed both spellings at once, which is how it was caught. Every other fenced
+  attribution line was swept against the server's register; this was the only
+  mismatch.
+- **"An answer about a place does not carry the ODbL line" — three words missing,
+  and the sentence reverses.** That wording is this release's own: 1.3.12 carried a
+  different wrong version of the same sentence (see the bullet below), and this one
+  was written while fixing that one and caught in review. The platform's own
+  wording is "a result about a
+  place **from our own gazetteer**, a station or a motorway is not built from
+  OpenStreetMap". Place resolution falls through the gazetteer to `osm_pois` and
+  then `osm_addresses`, so **every** tool that takes a `place` can return an
+  OSM-derived answer: measured on 2026-09-27, a weather warning for
+  `Zeiss-Großplanetarium` named `["dwd","osm"]` and carried the line, and one for
+  `Allianz Arena` named `["osm"]` alone. Both places on this page now carry the
+  qualifier and state the predicate — **which table answered**, not which tool
+  was called. Two wrong versions of this sentence have now been caught, and both
+  erred towards telling a reader an obligation did not apply to them. The last
+  round found the same error in the two places nobody re-reads after fixing a
+  paragraph: the **section heading** and its opening sentence still framed the
+  obligation as something that applies "if you get an address or a point of
+  interest back", so a reader who scans headings could conclude the section was
+  not theirs. Heading, lead and both bodies now state the predicate, and the
+  back-reference to the section was moved in the same edit as the heading.
+- **Twenty-one sources, not nineteen — and the table was missing a row it needs
+  to be the register it claims to be.** This release added the station car parks
+  row and recorded it in its own bullet below, without correcting the number it
+  invalidated; the review
+  then found the DELFI disruption feed has a licence row in the server's register
+  and no row here. It is in the table now, `read`, at **CC BY-SA 4.0**. Re-counted
+  by hand: 21 rows, 16 distinct publisher cells. The README's dare — "count them
+  in that table" — is a good one and now survives being taken up.
+- **The cleared-but-unused DELFI sentence was wrong in both halves, and it is a
+  licence statement.** It said "two more DELFI datasets … both CC BY 4.0 — the
+  share-alike is on the realtime feed". There are **three**, and two of them are
+  share-alike: the trip updates we serve and the disruption reports we do not.
+  Anybody planning for the day the disruption feed appears was being told to plan
+  for CC BY.
+- **The station car parks row had no attribution line, on a page that promises one
+  per source** — a defect this release created and closed. 1.3.12 has no car-parks
+  row anywhere, and its "three products" sentence was correct for what it listed;
+  adding the row, in the bullet that raised the source count, made that sentence wrong, so the Deutsche Bahn
+  section said "three products · CC BY 4.0" over four products and two licences. Both fixed, with the BahnPark attribution
+  line written out — `read`, so no answer carries it today, and it is here so
+  nobody has to go looking on the day one does.
+- **"No tool exposes the police traffic events yet" was a claim about the code,
+  and the code says otherwise.** That sentence is also this release's own — 1.3.12
+  carries the row at `read` and says nothing about reach. The road analysis already reads that feed, and
+  whether a source is NAMED is gated on a live catalogue row, so the row could
+  start carrying its attribution line with no release at all. The page now says
+  what it measured — `check_road_status` on the A40, A3, A1, A57 and A46 named
+  only the motorway interface and the BASt roadworks feed — and says out loud
+  that this is a statement about answers and not about reach. The row therefore
+  reads `in the service` and not `read`, and the page says not to design around
+  it.
+- **Two dead intra-document anchors, both created by this release's own
+  corrections.** The `no API key` badge — on the npm package page and the
+  repository front page — pointed at `#quick-start`, a heading this release
+  renamed to "Connect in one line"; and `SOURCES.md`'s back-reference to the
+  § 4.6 offer kept the old slug of a heading the previous review round renamed.
+  Every intra-document link in the tree was checked; these were the only two, and
+  both were ours. A later round found the shape that sweep could not see: an
+  issue **form** renders at `/issues/new?template=idea.yml`, so the relative
+  `../../blob/main/SOURCES.md` in it resolved one level short of the repository
+  and 404ed. It is an absolute URL now, like the one `config.yml` already used
+  for the same document.
+- **The one place where `SOURCES.md` is now NEWER than the server's register is
+  named on the page.** BKG is `live` there on five measured answers, while
+  `viafrei://attribution` still flags it as planned — "licence read, data not
+  ingested yet". The page's own rule is that the resource wins and the page is
+  stale; that rule is right in general and wrong for this row today, so both the
+  rule and the row now say so. No bridge release can close it: it is tracked where
+  the server is developed, and what a reader of the published page can act on is
+  the answer itself - `_meta.sources` and the attribution lines it carries.
+- **The charging answer does not count the sites without a status.** The page said
+  "a result says how many nearby sites had no status". It marks each one
+  `keine Statusdaten` and closes by saying that means unknown and not free —
+  measured, asking for Leipzig. What it refuses to do is leave them out or call
+  them free, which is the part that matters when you act on the answer.
+- **The test for "which answers carry the ODbL line" was the question, and it
+  should have been the answer.** `SOURCES.md` said the line is carried "on every
+  answer whose input was an address, and on no other answer". `find_poi` asked for
+  a name and a city returns `_meta.sources: ["osm"]` and the line — so a reader
+  using that sentence to decide whether a share-alike obligation had arisen would
+  have concluded it had not. The rule is now stated as the platform states it, and
+  the page says to read `_meta.sources` on the answer rather than infer anything
+  from the shape of the question.
+- **Our own § 4.6 offer was described more narrowly than it is.** It covers **both**
+  ODbL databases — addresses and points of interest, one file each under a single
+  licence notice — and the page named only the addresses. A recipient who derived
+  from POI results is entitled to the POI database.
+- **The README promised car parking the public service does not answer.** Asked for
+  a `car_park` in Köln, Hamburg and Leipzig on 2026-09-27, every facility returned
+  was a lorry park or unclassified, and none carried occupancy. The row now says
+  lorry parking and a note says what is missing and why — the same over-claim as
+  the rail row, one row up, in the table this release rewrote to stop over-claiming.
+- **The count of unconfirmed rows said two and there are three** — in a draft of
+  this release. 1.3.12 said **four**, counting a different set under a legend this
+  release replaced: under its own legend five rows said a source does not answer
+  today, and four was the number of `read` rows, which that legend defined as
+  "nothing uses it yet". The police-events row moved into the unconfirmed state
+  here, the changelog recorded the move and the count did not follow it. The station car-park source, in the server's register with no row
+  on the page at all, now has its `read` row.
+- **The Code of Conduct sent a reporter without a GitHub account to a postal
+  address that does not exist** — in its first draft, in this release. The document
+  is new here (see `### Added`), so no published version ever sent anybody
+  anywhere. The Impressum's street and city are still visible placeholders; only
+  the e-mail address is real, and that is what the document names. Nothing linked
+  to it either; the README's Contributing section does.
+
 ## [1.3.12] - 2026-09-23
 
 The bridge's code is unchanged since 0.0.9. This release replaces 1.3.10,
@@ -266,6 +948,8 @@ for it, so the number is free; the bridge will use it when the platform does.
   commits, and a squash makes them unreachable from `main` - which would turn
   the check red on `main` for everybody, for something no contributor did.
 
+[1.3.16]: https://github.com/mavrovde/viafrei-bridge/releases/tag/v1.3.16
+[1.3.15]: https://github.com/mavrovde/viafrei-bridge/releases/tag/v1.3.15
 [1.3.12]: https://github.com/mavrovde/viafrei-bridge/releases/tag/v1.3.12
 [1.3.10]: https://github.com/mavrovde/viafrei-bridge/releases/tag/v1.3.10
 [0.0.9]: https://github.com/mavrovde/viafrei-bridge/releases/tag/v0.0.9