viafrei 1.4.8 → 1.5.4

package/API.md

@@ -9,7 +9,7 @@ the server's own text, reproduced verbatim, because that text is what an
 assistant reads when it decides which tool to call; paraphrasing it here would
 document a different server.
 
-**It is a dated snapshot, taken on 2026-09-29.** Generating this file makes
+**It is a dated snapshot, taken on 2026-10-02.** Generating this file makes
 it impossible for the document and the snapshot to disagree — CI regenerates and
 compares — but it cannot keep the snapshot from ageing against the live server,
 because a capture is a point in time. **The source of truth is the running
@@ -17,12 +17,12 @@ server:** connect any MCP client and call `tools/list`.
 
 | | |
 | --- | --- |
-| Server | `viafrei` 1.4.8 |
+| Server | `viafrei` 1.5.4 |
 | MCP protocol | `2025-06-18` |
 | Streamable HTTP | https://mcp.viafrei.de/mcp |
 | Legacy HTTP+SSE | https://mcp.viafrei.de/sse |
-| Captured from | `https://mcp.viafrei.de/mcp` on 2026-09-29 |
-| Surface | 19 tools, 10 resources, 2 resource templates, 9 prompts |
+| Captured from | `https://mcp.viafrei.de/mcp` on 2026-10-02 |
+| Surface | 20 tools, 10 resources, 2 resource templates, 9 prompts |
 | Parameter schemas | JSON Schema draft-07 |
 | Capabilities | `tools`, `resources`, `prompts`, `logging` |
 
@@ -31,7 +31,7 @@ No API key. No account. No sign-up.
 ## Contents
 
 - [How to read a result](#how-to-read-a-result)
-- [Tools](#tools) — 19
+- [Tools](#tools) — 20
 - [Resources](#resources) — 10
 - [Resource templates](#resource-templates) — 2
 - [Prompts](#prompts) — 9
@@ -410,7 +410,7 @@ The server's own instructions to a connecting client, verbatim:
 
 **Read-only** — it changes nothing. Reaches a third-party source (open world). Idempotent: true. Destructive: false.
 
-> Return the next departures from a German railway station: time, line, destination, platform, delay and cancellations. Use when someone asks when their train, S-Bahn or ICE leaves, whether it is late, or what is leaving a station now — give the station name as the person said it ("Hamburg Hbf", "Munich Central"); an ambiguous name comes back as a list. Do NOT use for buses or trams (punctuality: check_transit_disruption), for tickets, fares or journey planning, or for motorway traffic — call check_autobahn_traffic. At most 15 departures, window 120 min. Results carry their attribution line.
+> Next departures from a German railway station, with platform, delay and cancellations. Use when asked when a train, S-Bahn or ICE leaves a named station, or whether THAT departure is late; vague later-today wording ("heute Abend") stays here. Whether ONE line is punctual ("ist die S1 pünktlich?") is NOT this tool, though it is rail and about delay — call check_transit_disruption. Do NOT use for buses, trams, a non-railway stop, another day or a time over 2 h away — get_departures. No destination filter: read the board. Max 15 departures, window 120 min. Results carry their attribution line.
 
 | parameter | type | required | default | constraints |
 | --- | --- | --- | --- | --- |
@@ -425,9 +425,33 @@ The server's own instructions to a connecting client, verbatim:
 - **`eva_no`** — The station's EVA number (6–8 digits, e.g. 8002549 for Hamburg Hbf), when a previous result gave you one. It skips the name lookup and is exact — use it to answer a follow-up about a station this tool has already named.
 - **`language`** — Set this on every call to the language the person is writing in: "en" if they wrote English, "de" if they wrote German. Do not leave it out because it has a default — the default is only the fallback when the language is genuinely unclear, and an English question answered in German is a wrong answer. Place names, station names and road numbers are never translated in either language; in English the German term is kept in parentheses so the person recognises it on signs and in local apps.
 - **`limit`** — How many departures to return, earliest first (1–15, default 10). More than 15 is refused — that is a board a person can read, not a dataset.
-- **`station`** — The railway station, as the person says it: "Hamburg Hbf", "Köln Hbf", "Munich Central", "Frankfurt (Main) Hbf". Pass their words — English names and "central station" are understood. If the name fits several stations the result lists them and asks which; do not guess one yourself. Give either station OR eva_no, never both.
+- **`station`** — The railway station, as the person says it: "Hamburg Hbf", "Köln Hbf", "Munich Central", "Frankfurt (Main) Hbf". Pass their words — English names and "central station" are understood. If the name fits several stations (a bare "Hauptbahnhof"), call anyway: the result lists them and asks which; do not guess one yourself. Give either station OR eva_no, never both.
 - **`when`** — Start of the window as an ISO-8601 instant with an offset ("2026-09-20T18:30:00+02:00"). Leave it out for "now", which is what almost every question means. Times in the answer are Europe/Berlin whatever you pass.
 
+### `get_departures` — Scheduled departures (bus, tram, train)
+
+**Read-only** — it changes nothing. Answers from data this service already holds (closed world). Idempotent: true. Destructive: false.
+
+> Scheduled departures from any German public-transport stop — bus, tram, U-Bahn, S-Bahn, train, ferry — with line, destination, platform. Use when someone asks when a bus, tram, U-Bahn or ferry goes, or for another DAY or a clock time over 2 h away: "Wann fährt der nächste Bus ab Fulda Bahnhof?" Do NOT use for a railway station's trains now or later today — get_train_departures. Planned times only: for "is my bus late?" give the plan and say so; regional punctuality check_transit_disruption. No destination filter: read the board. Window 48 h, 15 per call. Results carry their attribution line.
+
+| parameter | type | required | default | constraints |
+| --- | --- | --- | --- | --- |
+| `duration_min` | integer | no | `60` | min 5; max 1440 |
+| `language` | string | no | `"de"` | one of `"de"`, `"en"` |
+| `limit` | integer | no | `10` | min 1; max 15 |
+| `modes` | array of string | no | — | min 1 item(s); each item: one of `"rail"`, `"subway"`, `"tram"`, `"bus"`, `"ferry"` |
+| `stop` | string | no | — | min length 2 |
+| `stop_id` | string | no | — | min length 3 |
+| `when` | string | no | — | format `date-time`; pattern (288 characters — see the description; the `format` above is the short answer) |
+
+- **`duration_min`** — How far past that moment to look, in minutes (5–1440, default 60). Small for "what goes now", a few hours for an evening. To reach the far end of the 48 h timetable, move `when` instead of widening this: a window of a whole day returns at most 15 rows and would answer about the wrong half of it.
+- **`language`** — Set this on every call to the language the person is writing in: "en" if they wrote English, "de" if they wrote German. Do not leave it out because it has a default — the default is only the fallback when the language is genuinely unclear, and an English question answered in German is a wrong answer. Place names, station names and road numbers are never translated in either language; in English the German term is kept in parentheses so the person recognises it on signs and in local apps.
+- **`limit`** — How many departures to return, earliest first (1–15, default 10). The result always says how many more were in the window.
+- **`modes`** — Keep only these kinds of service: "bus", "tram", "subway" (U-Bahn), "rail" (every train, including S-Bahn and regional) or "ferry". Omit it unless the person named a kind — "nur Busse", "welche Tram". Several are allowed, which is what "die Busse und Bahnen vor dem Hbf" means. An S-Bahn is "rail": the feed does not always distinguish it, and the line name ("S 6") says which it is.
+- **`stop`** — The stop, as the person says it: "Fulda, Bahnhof", "München, Marienplatz", "Köln, Hbf", "Hamburg, Rathausmarkt" (town first). Include the town when the person did — half the names in Germany exist in twenty towns, and a bare "Bahnhof" or "Hauptbahnhof" comes back as a list of candidates to choose from, so call it and let the result ask. Pass their words; do not guess an id. Give either stop OR the stop id, never both.
+- **`stop_id`** — The stop's timetable id, exactly as a previous result of this tool gave it ("de:06631:1234"). It skips the name lookup and is exact — use it for a follow-up about a stop this tool has already named, and for one the person picked out of a candidate list.
+- **`when`** — Start of the window as an ISO-8601 instant with an offset ("2026-10-02T07:30:00+02:00"). Leave it out for "now". Convert the person's words yourself — "morgen früh", "tonight" — and pass the instant; the answer is always rendered in Europe/Berlin.
+
 ### `check_station_facilities` — Station lifts and escalators
 
 **Read-only** — it changes nothing. Reaches a third-party source (open world). Idempotent: true. Destructive: false.
@@ -655,5 +679,5 @@ single call.
 ---
 
 Generated from `catalogue.json` by `scripts/gen-api-doc.mjs`. The snapshot was
-read from `https://mcp.viafrei.de/mcp` on 2026-09-29; no tool was invoked to
+read from `https://mcp.viafrei.de/mcp` on 2026-10-02; no tool was invoked to
 produce it, so no data provider was contacted.

package/CHANGELOG.md

@@ -5,7 +5,360 @@ a Changelog and the versions follow Semantic Versioning.
 
 ## [Unreleased]
 
-Nothing yet.
+## [1.5.4] - 2026-10-02
+
+**Mirrors the server.** The bridge is versioned to match the ViaFrei MCP server it
+relays to. The running server reports 1.5.4 while the registry's latest is 1.4.9, so
+this release moves the package to the server's number and carries whatever had been
+waiting under `[Unreleased]`. Prepared by the `Version sync` workflow: the shipped
+reference was re-captured from the running server, and the probe reported the surface
+**CHANGED** — the automation knows what moved, not what it means:
+
+- tools: the server has get_departures, the snapshot does not
+- tools: get_train_departures differs between the server and the snapshot
+
+What that means, written by a person after reading the diff and asking the server:
+
+- **`get_departures` is new**: scheduled departures from any German public-transport
+  stop — bus, tram, U-Bahn, S-Bahn, train, ferry — with line, destination and
+  platform, planned times only, a 48 h window and 15 per call, answering from the
+  DELFI static timetable (CC BY 4.0). It is the tool for "when does the next bus go",
+  for another day, or for a clock time more than two hours away. Asked on 2026-10-02,
+  prod answered that the timetable is **not loaded yet** and said so plainly instead
+  of inventing a board; `SOURCES.md` records that on the static-GTFS row rather than
+  promoting the source to *live*.
+- **`get_train_departures` was re-described, not re-shaped**: its description now
+  draws the line against the new tool (buses, trams, a non-railway stop, another day
+  or a time over two hours away go to `get_departures`), keeps vague later-today
+  wording for itself, and sends "is the S1 punctual?" to `check_transit_disruption`
+  even though it is rail and about delay. The `station` argument's text adds that a
+  bare "Hauptbahnhof" should be sent as-is because the server lists the candidates.
+  No argument was added, removed or re-typed.
+- The catalogue is **20 tools, 18 read-only**; `SOURCES.md` moves from nineteen /
+  seventeen to those numbers, and the live calls a re-measurement would cost from
+  fifteen to sixteen, because the tool gained is read-only and not fuel.
+
+### Added
+
+- **A scheduled freshness probe: is the service alive, not merely answering?**
+  (`scripts/probe-freshness.mjs`, `npm run probe:freshness`, and the `Freshness`
+  workflow every six hours.)
+
+  The gap it closes was real and nothing here could see it. A server can return
+  `200` with a correctly shaped body for days while an ingest worker is dead, and
+  every existing check survives that: the stub tests prove the bridge's
+  **transport**, `check:docs` proves the document matches the **snapshot**, and the
+  cut-time probe proves the **surface** still matches. None of them reads the age
+  of the data in an answer.
+
+  This asks the running server and judges `_meta.asOf`, which every real-time tool
+  carries, against a limit **per tool**. That is not a detail: measured against
+  prod on 2026-10-01, autobahn, transit, weather and departures all answered within
+  a minute while `check_road_status` was **7.5 h** old, because it blends the BASt
+  roadworks feed, which the Mobilithek catalogue declares as **twice daily**. One
+  global limit would be either useless for the fast feeds or permanently red for the
+  slow one — and a check that is permanently red is a check that gets switched off.
+
+  Each limit sits about an order of magnitude above the source's own **declared
+  cadence** rather than above the single reading this was written against, so it
+  catches a dead worker and cannot fire on normal variation. 72 h for roadworks is
+  roughly six times a twice-daily interval and clears a weekend; 90 min for the
+  other four is many times their providers' own floors.
+
+  **The callable set is an allow-list, not a deny-rule**, and the direction is the
+  point: with a deny-rule a new entry runs unless it matches, and here the failure
+  mode is a licence breach against a provider that can revoke access. Fail-closed is
+  the right default on that path, so a tool nobody named is refused.
+
+  **No fuel tool is ever called**, stated separately because it carries the reason
+  the allow-list does not: `find_cheapest_fuel` and `find_fuel_station` answer from
+  MTS-K / Tankerkönig, which sets a minimum interval per station and limits use to
+  answering a consumer's question. A monitoring query is not that. Both guards
+  **refuse before any request**, and the fuel arm is not redundant — a self-test
+  case adds a fuel tool to **both** lists, which is the realistic way the exclusion
+  would be lost, and it is still refused on licence grounds.
+
+  **Scheduled, not on push**, because CI here reaches nothing by design: a
+  freshness failure is news about the service, not about the commit, and reddening
+  a contributor's push for it would teach people to ignore red.
+
+  **The instrument is proved before it is trusted**, and the workflow runs the two
+  steps in that order. The self-test is hermetic — every case against a local stub
+  on loopback — and it is the only place the staleness verdict is ever exercised,
+  because a healthy endpoint cannot produce a stale payload. So the self-test runs
+  **first**: if it fails the instrument is broken, and if the live step fails the
+  service is. A monitor whose verdict is never proved reports success about a dead
+  service exactly as convincingly as about a live one.
+
+  Three exit codes, because "could not check" and "checked and it is wrong" are
+  different answers: `0` every feed inside its limit, `1` a real defect (stale, or
+  no `asOf`, or no attribution, or `isError`, or an `asOf` in the future — a clock
+  fault must not read as very fresh), and `2` could not check (endpoint, session,
+  or a response shape nobody recognises). An unparsable body is deliberately `2`
+  rather than `1`.
+
+  Found by its own self-test and fixed: `--json` printed the human summary to
+  stdout after the document, so the stream did not parse. Both streams are now
+  pinned by a case.
+
+  **Found in review, and it is the case the first draft had no test for.** A
+  JSON-RPC *error* — what the server returns for a retired tool or a renamed
+  argument, and this watch list hard-codes seven argument names — fell through to
+  the no-result branch: **exit 1, every feed printed `STALE`, on a healthy
+  service**, and `error.message`, the entire diagnosis, discarded. It is now exit
+  **2** with the server's code and message printed, a distinct `?????` label
+  because `STALE` is a claim about the *data* rather than about our ability to
+  measure it, and a refusal sentence that no longer says the body failed to parse —
+  it parsed perfectly. Four assertions cover it, and removing the guard turns all
+  four red.
+
+- **The registry is compared with the server every six hours, and a release that
+  would close the gap is PREPARED — never performed** (`scripts/propose-release.mjs`,
+  `npm run propose:release`, and the `Version sync` workflow).
+
+  The bridge is versioned to match the server it relays to, and until now the only
+  thing that noticed the registry falling behind was a person checking by hand: 1.4.9
+  sat on prod while npm said 1.4.8 until somebody asked. Every step of catching up
+  was mechanical and identical each time — `npm version`, the probe's `--write`,
+  `docs:api`, the `## [X.Y.Z]` block, the gates — so the workflow does them and
+  pushes the result as `release/X.Y.Z` with a pull request.
+
+  **What it will not do, by design.** It does not merge, tag or publish, for three
+  reasons each sufficient alone: the merge needs a reviewer verdict covering HEAD,
+  which a bot merging through the API would bypass; an npm version is immutable, so
+  a wrong one is forever; and when the server's **surface** changed rather than its
+  number, the release note needs a sentence about what the change means, which
+  nothing here can write — the 1.4.9 cut carried a licence-relevant fix for exactly
+  that case. So the verdict, the merge and the tag stay with a person, and the tag
+  publishes as it always has.
+
+  **Four states, each named in the output**, because the workflow branches on them:
+  `in-sync`, `awaiting-tag` (main already carries the server's version; the tag is
+  the missing step), `drift` (the one that is prepared), and `behind` — the server
+  BEHIND the registry, which is exit 1 and proposes nothing, because a downgrade is
+  a decision about whether prod rolled back or a publish was premature.
+
+  **Every version string read from the network is checked against `X.Y.Z` before it
+  is used anywhere**, since it ends up in a branch name, a commit and an `npm
+  version` argument; a prerelease on either side is a refusal. A mutant with the
+  guard removed is part of the self-test, so the guard is proved live rather than
+  present. Detect **writes nothing**, asserted by hashing the five files it may
+  later touch. The server is read through the catalogue probe — one reader of that
+  endpoint, `initialize` and the four list calls, no tool invoked — and the probe's
+  own WRONG/DATED verdict decides the lead of the CHANGELOG block: DATED says the
+  surface is unchanged; WRONG lists what moved and says **a person must describe it
+  before this merges**, and the pull request is opened as a **draft**. A failing
+  offline gate is also a draft rather than a lost run: the gate's output goes into
+  the pull request, where the person who has to act on it will read it.
+
+  A proposal is idempotent across runs — a `release/X.Y.Z` branch already on origin
+  is left alone, so a pull request waiting for its review is not joined by a twin
+  every six hours — and a CHANGELOG already carrying the block is a refusal. The
+  workflow dispatches CI on the branch explicitly, because a push or a pull request
+  made with the workflow token starts no workflow by GitHub's rule. **Two
+  preconditions are asserted before anything is read**, because each failure would
+  otherwise conceal itself: the run must be on the default branch (a dispatch from
+  another ref would branch off it and open a pull request carrying its commits), and
+  the repository must allow Actions to open pull requests — a setting that is OFF by
+  default (and was, here, until 2026-10-02), without which `gh pr create` fails after
+  the branch is pushed and the orphan branch then silences every later run. That
+  read is administration-class and the workflow token may not be able to make it,
+  so it has **three outcomes**: a successful `false` refuses, a failed read is named
+  and the run continues, because if the pull request still cannot be opened the
+  branch just pushed is deleted again for the same reason.
+
+  The MCP stub the catalogue probe's self-test ran on moved to `scripts/mcp-stub.mjs`,
+  and the pass/fail counter both self-tests print through to `scripts/check-harness.mjs`,
+  so this self-test shares them rather than carrying copies; the probe's own case
+  count is unchanged.
+
+### Fixed
+
+- **The `Version sync` workflow runs the leak sweep on the tree it prepares.** Its
+  first real run was this release, and the proposal it pushed carried two bare
+  numbers from the new tool's schema text — a minutes-per-day maximum and an example
+  stop id — that the public-repo sweep refuses. Nothing in the workflow had asked:
+  its three gates compare the shipped files with each other, not whether the
+  snapshot may be published. What caught it was the CI run the workflow itself
+  dispatched — the pull request's own `pull_request` run never executed, it sat at
+  `action_required` — and the step that failed was the publish-hygiene gate on the
+  **built tarball**, because `API.md` ships in the package: the numbers were on their
+  way into the published artefact, not only into the repository. The sweep now runs
+  after the five files are staged, and a finding makes the proposal a **draft** with
+  the findings in the pull-request body. That job builds nothing, so it cannot run
+  the tarball gate itself: it covers this class of finding, not the exact gate that
+  fired. The two numbers are on `numbers.allowed` as the harmless values they are;
+  both exist only in text the server controls, so a re-wording upstream makes the
+  sweep refuse them as unused — loudly, which is the right direction.
+- **`check-sources`' self-test reads its counts off the check's own summary line**
+  instead of carrying them: three of its cases said "seventeen" and "fifteen", and
+  when the page correctly moved to eighteen and sixteen they went inert — one passed
+  without mutating anything — or asserted the previous release's numbers. A mutation
+  that changes nothing, or that would change one of two occurrences, is now a
+  refusal. The check's own pattern for the re-run sentence accepts "would now mean"
+  beside "would still mean", because the count did move this time and the page says
+  so.
+
+## [1.4.9] - 2026-10-01
+
+**Mirrors the server.** The bridge is versioned to match the ViaFrei MCP server
+it relays to, and prod moved to 1.4.9; this release carries the three changes
+that had been waiting under `[Unreleased]` for a number to mirror. The shipped
+reference was re-captured from the running server at the cut, and the probe that
+did it reported the surface **unchanged** — only the version string and the
+capture date moved.
+
+### Added
+
+- **The sources page is now checked against the catalogue snapshot** (`scripts/check-sources.mjs`,
+  `npm run check:sources`), in CI and in the publish workflow (#32).
+
+  `SOURCES.md` states counts *about the server* — how many tools it exposes, how many are
+  read-only, which are fuel and therefore excluded from its spot check. Nothing compared
+  them with `catalogue.json`, which ships in the same tarball and holds the answers, and
+  the page spent two releases describing a server it no longer matched.
+
+  **Offline on purpose, and that is what makes it worth having.** Both files already ship
+  together, so this needs no network and runs on every push rather than at the cut. It
+  would have caught all three defects of the previous entry, including the one that got
+  past a first review round: the **derived** call count is computed as read-only minus the
+  excluded fuel tools, never read from the prose, because that is the one number on the
+  page a reader might act on.
+
+  The licence arm is the one that matters: a fuel tool present in the snapshot and not
+  named by the page is a failure, because that exclusion is an MTS-K condition rather
+  than a convenience, and a tool counts as fuel-constrained if its NAME says so **or**
+  its DESCRIPTION names the provider — measured on this snapshot, both fuel tools name
+  theirs in prose and no other tool does, so a rename alone cannot hide one. `npm run
+  test:sources` prints the case count; no number is written here, because this entry's
+  first draft stated one and it was stale within the round.
+
+  Two limits are pinned rather than assumed. A fuel rule gone inert REFUSES (exit 2)
+  instead of reporting an empty excluded set. And a tool renamed away from `fuel` *whose
+  description also stops naming the provider* matches neither arm and is not on the floor,
+  so that one still fails through the arithmetic, with a message about a call count rather
+  than about an unprotected tool. That is the honest reach of two text rules, and the
+  weaker behaviour is asserted rather than hoped for.
+
+- **A cut-time probe that compares the shipped reference with the running server**
+  (`scripts/probe-catalogue.mjs`, `npm run probe:catalogue`; `--write` re-captures) (#33).
+
+  At the 1.4.6 cut the shipped reference described server 1.3.22 and omitted a tool the
+  server exposed. `check:docs` passed throughout — it proves `API.md` matches
+  `catalogue.json`, so **a stale pair passes together**. Nothing compared either with the
+  server.
+
+  **It is deliberately not a CI step.** This repository's test posture is that CI reaches
+  nothing, which is why every other check here is offline; a comparison with the running
+  server needs a network call, so this is run by a person at the cut and is the only
+  script here that touches the network. It is named `probe:` rather than `check:` so that
+  distinction is visible in `package.json`.
+
+  Read-only: `initialize` and the four list calls, **no tool invoked**, session deleted
+  afterwards. That is a licence requirement and not courtesy — the fuel source sets a
+  per-station floor.
+
+  **Its report distinguishes WRONG from DATED**, because those are the two real histories
+  and they need different remedies: 1.4.6's reference omitted a tool, which misleads a
+  reader about what they are holding; 1.4.8's had only a stale version string. Reporting
+  one as the other would be worse than no probe. Ten self-test cases, none of which touch
+  the network — every one runs against a local stub — including both halves of that
+  distinction, an empty list refused rather than compared equal, and `--write` proved to
+  produce a snapshot the comparator then accepts.
+
+- **`runToolAsync`** in `scripts/tools.mjs`, with the same deadline and refusal as
+  `runTool`. The synchronous runner blocks the caller's event loop, so a caller that is
+  itself serving the child cannot use it — the probe's self-test serves a stub in-process
+  and spawns the probe against it, and every case deadlocked until this existed. Added to
+  the one `SPAWNERS` array the bare-name sweep derives from, so it is covered by the same
+  rule as its sibling rather than being a quiet exemption.
+
+### Fixed
+
+- **Both CI deprecation warnings, in both workflows.** `build-and-test` was emitting two
+  notices: the Node-20 runtime of `actions/checkout@v4` and `actions/setup-node@v4` is
+  deprecated and GitHub is already forcing those actions onto Node 24, and the
+  `ubuntu-latest` label migrates to Ubuntu 26 from 2026-10-19.
+
+  **The warning named one workflow; the measurement named two.** `publish.yml` pinned both
+  actions by commit sha, which looked like the careful half of the repository — but
+  `action.yml` at each of those pinned shas declares `using: node20`. So the workflow that
+  publishes to npm was on the deprecated runtime too and said nothing about it, because a
+  sha pin does not report its own age. A fix confined to `ci.yml` would have cleared the
+  log and left the publish path exactly where it was.
+
+  Both files now pin the same runner image, `ubuntu-24.04`, and the same two actions by
+  sha: checkout **v7.0.1** and setup-node **v7.0.0**, resolved from the API rather than
+  transcribed, and each verified to declare `using: node24` at the sha actually pinned —
+  which is what closes the notice rather than deferring it. That also leaves one version
+  of each action in the repository instead of two.
+
+  **v7, not v5, and it is a three-major move.** v5 clears today's warning and leaves this
+  repository two majors behind the same deadline. The first draft of this entry described
+  v7.0.0's release notes and called them the only behaviour change — true of that release,
+  false of the upgrade, and the paragraph's whole job is to justify the size of the jump.
+
+  The jump was therefore checked mechanically instead, which is shorter and re-runnable:
+  **diff the declared input sets at the two shas.** Across v4.4.0 → v7.0.0 setup-node
+  removes exactly one input, `always-auth`, and adds `package-manager-cache`; checkout
+  removes and adds none. Between them the two workflows pass four inputs — `node-version`,
+  `registry-url`, `cache` and `fetch-depth` — and all four are still declared, so the
+  `registry-url` → `.npmrc` path the publish depends on is intact.
+
+  The breaking changes the intervening majors do declare are inert here, by enumeration
+  rather than by assumption: setup-node v5's automatic package-manager detection and v6's
+  narrowing of it to npm cannot apply, because both jobs pass `cache: npm` explicitly and
+  this `package.json` has no `packageManager` field; checkout v5's minimum runner version
+  (2.327.1) is far below what GitHub-hosted runners run; checkout v7's refusal to check out
+  a fork's head applies to `pull_request_target` and `workflow_run`, neither of which
+  appears anywhere under `.github/`; and setup-node v7's removal of the dummy
+  `NODE_AUTH_TOKEN` export is an **improvement** on this path — that variable appears
+  nowhere in either workflow, and upstream's own pull request says the dummy value could
+  corrupt an `.npmrc` during an OIDC publish, which is how publishing here works.
+
+  One is named rather than waved past, because it touches the publish gate. checkout v6
+  moved the persisted git credential into a separate file, and `publish.yml` runs one git
+  command that touches the remote after checkout: the `git fetch origin main` the
+  tag-containment guard needs (the step's other two, a `rev-parse` and a `merge-base`, are
+  local). This repository is public, so that fetch succeeds with or without a credential;
+  and if it ever did not, the guard exits **2** and refuses to publish rather than
+  publishing a commit `main` does not contain. Fail-closed, so the bad outcome is a blocked
+  release and never a wrong one. It is also the one step a `workflow_dispatch` dry run
+  cannot exercise, since the guard is gated on a tag.
+
+  A floating tag is what hid this, so nothing here floats: all four `- uses:` lines in the
+  repository are now `@<sha> # vX.Y.Z`, and neither `runs-on` is a label that can change
+  under a workflow nobody re-read.
+
+  Written while prod and the registry were both at 1.4.8, so this said "no version bump:
+  there is no number to mirror". Prod moved to 1.4.9 before the cut, so the number now
+  exists and this ships under it.
+
+- **`SOURCES.md` claimed a measurement that stopped being true, and the stale half is
+  a licence condition.** The page said its status column was measured by calling
+  "fifteen of the server's sixteen read-only tools — every one except
+  `find_cheapest_fuel`". As of the 2026-09-29 capture shipped alongside it, the server
+  exposes nineteen tools, seventeen of them read-only, and — this is the part that
+  matters — a **second** fuel tool, `find_fuel_station`.
+
+  The exclusion of `find_cheapest_fuel` is not a convenience: MTS-K sets a minimum
+  interval per station and its terms make needless querying a real risk to the access
+  itself. That reasoning applies to `find_fuel_station` identically, and the page did
+  not name it, so a reader following the page's own method would have called a fuel
+  tool the page meant to exclude.
+
+  The measurement is now scoped to the date and the server it was taken against, the
+  growth since is stated, and **both** fuel tools are named as excluded. It is
+  deliberately **not** re-run: that would still cost **fifteen** live calls against
+  real providers to re-confirm statuses already known — the same fifteen as at the
+  original measurement, because the one read-only tool the server gained is the
+  second fuel tool and is excluded. Sixteen minus one was fifteen; seventeen minus
+  two is fifteen again. Dated on purpose, and said out loud — a measurement carried forward under a present-tense sentence is
+  the failure that section exists to avoid.
+
+  Not released on its own: when it was written prod was at 1.4.8, already published, and
+  putting the package a patch ahead of the endpoint it relays to would have been worse than
+  waiting. It rode the next version sync, which is this one.
 
 ## [1.4.8] - 2026-09-29
 
@@ -1292,6 +1645,8 @@ for it, so the number is free; the bridge will use it when the platform does.
   commits, and a squash makes them unreachable from `main` - which would turn
   the check red on `main` for everybody, for something no contributor did.
 
+[1.5.4]: https://github.com/mavrovde/viafrei-bridge/releases/tag/v1.5.4
+[1.4.9]: https://github.com/mavrovde/viafrei-bridge/releases/tag/v1.4.9
 [1.3.22]: https://github.com/mavrovde/viafrei-bridge/releases/tag/v1.3.22
 [1.3.16]: https://github.com/mavrovde/viafrei-bridge/releases/tag/v1.3.16
 [1.3.15]: https://github.com/mavrovde/viafrei-bridge/releases/tag/v1.3.15

package/SOURCES.md

@@ -134,18 +134,44 @@ one labelled `not re-measured`** was checked by calling the public endpoint on
 **2026-09-27** and reading which source the answer named. A source can be licensed, cleared and loaded and still not answer
 a question today; where that is so, this page says it.
 
-The measurement was taken by calling **fifteen of the server's sixteen read-only
-tools — every one except `find_cheapest_fuel`** — once each, and reading
-`_meta.sources` out of the result: not by reading the code, and not by asking
-whether a feed was running. Thirteen sources were named by at least one answer.
-The tool not called is the one whose row is deliberately not re-measured, and
-the count above says so rather than absorbing it: a status this page cannot stand behind is
-worse than an honest gap.
+The measurement was taken **on 2026-09-27**, when the server exposed sixteen
+read-only tools, by calling **fifteen of them — every one except
+`find_cheapest_fuel`** — once each, and reading `_meta.sources` out of the result:
+not by reading the code, and not by asking whether a feed was running. Thirteen
+sources were named by at least one answer. The tool not called is the one whose row
+is deliberately not re-measured, and the count says so rather than absorbing it: a
+status this page cannot stand behind is worse than an honest gap.
+
+**The server has grown since that measurement, and this page has not re-run it.**
+As of the 2026-10-02 capture shipped alongside this page it exposes twenty tools,
+eighteen of them read-only. Between that measurement and the 2026-10-02 capture it
+gained two tools, and both matter here. One is a SECOND fuel tool,
+`find_fuel_station`, excluded from any spot check for exactly the same reason
+`find_cheapest_fuel` is, and the reason is a licence condition rather than a
+convenience: MTS-K sets a minimum interval per station and its terms make needless
+querying a real risk to the access itself. **Both fuel tools are excluded, not one.**
+The other is `get_departures` (server 1.5.4): scheduled departures from any
+public-transport stop, answering from the DELFI static timetable — a source this
+page had listed as *read* with nothing using it. Something uses it now, and on
+2026-10-02 the server's own answer was that the timetable is not loaded yet; the row
+below says exactly that rather than promoting it.
+
+The sentence above therefore describes what was measured on 2026-09-27 and not what
+the server offers today. Re-running it would now mean **sixteen** live calls against
+real providers: the read-only tools minus the two excluded fuel tools. The count moved
+by one because `get_departures` is read-only and not fuel, so a re-run would call
+it. Those calls would mostly re-confirm statuses this page already knows, so it is
+dated on purpose rather than refreshed on a schedule — and dated is said out loud,
+because a measurement silently carried forward under a present-tense sentence is the
+failure this section exists to avoid.
 
 - **live** — an answer came back naming it when this page was checked;
 - **in the service** — licensed and loaded, and the spot check produced no
   answer that named it, so it is reported as unconfirmed rather than as live;
-- **read** — the licence is read and cleared, and nothing uses it yet.
+- **read** — the licence is read and cleared, and no answer has been seen from it:
+  because nothing asks it, because what asks it is told the data is not loaded, or
+  because what asks it has not been seen to get an answer either way. Where it is not
+  simply that nothing asks it, the row says so.
 
 There used to be a fourth value, **not on the public service today**, and no row
 carries it any more: the three rows that did now answer. It is removed from this
@@ -169,8 +195,8 @@ status somebody could still be relying on.
 | Public-transport realtime (GTFS-RT Trip Updates) | DELFI e.V., via the national access point (Mobilithek) | Germany-wide departure and arrival forecasts | real time | **CC BY-SA (version unstated)** | live |
 | FaSta — Facility Status | Deutsche Bahn AG (DB API Marketplace) | Live state of lifts and escalators at stations | live status | CC BY 4.0 | live |
 | Geocoding (addresses and points of interest) | OpenStreetMap contributors | Street and house-number points and mapped points of interest in Germany | refreshed from the OSM extract | **ODbL 1.0** | live |
-| Timetable data (static GTFS) | DELFI e.V. | Germany-wide scheduled public transport | weekly release | CC BY 4.0 | read |
-| Stop directory (zHV) | DELFI e.V. | Every public-transport stop in Germany with its identifier and coordinates | weekly release | CC BY 4.0 | read |
+| Timetable data (static GTFS) | DELFI e.V. | Germany-wide scheduled public transport | weekly release | CC BY 4.0 | read — asked by `get_departures` since server 1.5.4; on 2026-10-02 the server answered that the timetable is not loaded yet, and said so rather than inventing a board |
+| Stop directory (zHV) | DELFI e.V. | Every public-transport stop in Germany with its identifier and coordinates | weekly release | CC BY 4.0 | read — `get_departures` resolves stop names against it since server 1.5.4; the 2026-10-02 answer named no stop and said only that the timetable is not loaded, so whether the directory answered cannot be read off it |
 | Disruption reports (Störungsmeldungen) | DELFI e.V., via the national access point (Mobilithek) | Germany-wide public-transport disruption messages | real time | **CC BY-SA 4.0** | read |
 | Station car parks (DB BahnPark) | Deutsche Bahn AG (DB API Marketplace) | Car parks at railway stations, with their operator and access details | continuous | **dl-de/by-2-0** | read |
 | Administrative units and place names | Bundesamt für Kartographie und Geodäsie (BKG), product GN250 | Länder, Regierungsbezirke, Kreise, Gemeinden with their official keys and names | yearly release | **dl-de/by-2-0** | live |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "viafrei",
-  "version": "1.4.8",
+  "version": "1.5.4",
   "description": "German traffic, rail, parking, charging, fuel, address and weather data in your AI assistant - MCP, no API key. stdio bridge to the hosted ViaFrei MCP server.",
   "keywords": [
     "mcp",
@@ -75,6 +75,14 @@
     "check:versions": "node scripts/check-versions.mjs",
     "docs:api": "node scripts/gen-api-doc.mjs",
     "check:docs": "node scripts/gen-api-doc.mjs --check",
+    "check:sources": "node scripts/check-sources.mjs",
+    "test:sources": "node scripts/check-sources.test.mjs",
+    "probe:catalogue": "node scripts/probe-catalogue.mjs",
+    "test:probe": "node scripts/probe-catalogue.test.mjs",
+    "probe:freshness": "node scripts/probe-freshness.mjs",
+    "test:freshness": "node scripts/probe-freshness.test.mjs",
+    "propose:release": "node scripts/propose-release.mjs",
+    "test:propose": "node scripts/propose-release.test.mjs",
     "rules:show": "node scripts/show-rules.mjs"
   },
   "dependencies": {