MetaList 0.7.5__tar.gz → 0.8.0__tar.gz

{metalist-0.7.5/metalist.egg-info → metalist-0.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: metalist
-Version: 0.7.5
+Version: 0.8.0
 Summary: A minimalist single-user note-taking app with SSR, fast in-memory tree operations, and efficient sync.
 Project-URL: Homepage, https://github.com/evolvingstuff/metalist
 Project-URL: Repository, https://github.com/evolvingstuff/metalist
@@ -48,6 +48,11 @@ A minimalist single-user note-taking app focused on server-side rendering (SSR),
 - Multi-tab search contexts with server-persisted scroll/search state (survives browser restarts)
 - Manual namespace backups/restores to a user-selected backup folder with retention controls
 
+## Changes in 0.8.0
+
+- Error diagnostics now record safe request IDs, exception types, and source locations through Loguru; full tracebacks are available only in authenticated encrypted logs.
+- Releases run the full cross-platform matrix once on the `main` push. The tag publishes those exact tested distributions without rerunning the matrix.
+
 ## Changes in 0.7.5
 
 - Unexpected API 500 errors now show the exception class and MetaList source line in the browser, without exposing note contents, exception messages, or local filesystem paths.
@@ -57,7 +62,7 @@ A minimalist single-user note-taking app focused on server-side rendering (SSR),
 
 - Updates use a private, checksum-verified uv release on Windows, macOS, and Linux. The updater does not execute a user-installed uv, and it revalidates both the cached official archive and extracted executable before each use.
 - The HTTPS listener retries one bodyless safe request after a transient backend reset, records final transport failures server-side, and never replays a mutation or request body.
-- Release CI builds one distribution pair, starts independent platform/Python, installed-update, browser-smoke, and browser-soak gates in parallel, and caches only hash- or lockfile-verified dependencies. Cross-platform runtime changes must pass branch CI before merge.
+- Release CI builds one distribution pair, starts independent platform/Python, installed-update, browser-smoke, and browser-soak gates in parallel, and caches only hash- or lockfile-verified dependencies.
 
 ## Changes in 0.7.3
 
@@ -356,9 +361,9 @@ This repo now packages itself under the PyPI distribution name `metalist`. Curre
 
 Recommended release path:
 1. In the existing PyPI project `metalist`, configure GitHub Trusted Publishing for `evolvingstuff/metalist` and the workflow file `.github/workflows/publish-pypi.yml`.
-2. Push the candidate commit to a branch and wait for the `Publish to PyPI` validation workflow to pass for that exact commit. GitHub-hosted Windows, macOS, and Linux runners install the built wheel and test application startup outside the source checkout on Python 3.10 through 3.14. Every matrix job also exercises the real `metalist update` path with uv, backups, interpreter preservation, and two-namespace restart against a local release index. The old-version fixture carries the candidate updater so this validates the mechanism being shipped; it does not retroactively fix older installed updaters. You do not need those operating systems locally. Archive verification also checks runtime files, including agent Markdown resources, against both the wheel and source distribution.
-3. Only after every required check passes, create and push the release tag for that same commit. Any intervening change requires a new validation run before tagging. Branch and pull-request runs validate without publishing.
-4. The tag workflow repeats validation and publishes the same artifacts tested by its full matrix. Manual publication also requires all checks to pass. Users can then run it with `uvx metalist`, install it persistently with `uv tool install metalist`, or install it with `pip install metalist`.
+2. Develop and review the candidate on a feature branch with focused checks. Merge it into `main` and push `main` once. This runs the full `Publish to PyPI` validation matrix for that exact commit. GitHub-hosted Windows, macOS, and Linux runners install the built wheel and test application startup outside the source checkout on Python 3.10 through 3.14. Every installed-package matrix job also exercises the real `metalist update` path with uv, backups, interpreter preservation, and two-namespace restart against a local release index. The old-version fixture carries the candidate updater so this validates the mechanism being shipped; it does not retroactively fix older installed updaters. You do not need those operating systems locally. Archive verification checks runtime files, including agent Markdown resources, against both the wheel and source distribution.
+3. Wait for the exact-commit main release matrix to pass, then run `.venv/bin/python scripts/release.py X.Y.Z` to create and push the tag. Any intervening change requires a new main validation run before tagging.
+4. The tag job independently verifies every main-job conclusion and reuses the wheel and source distribution from that run for GitHub Trusted Publishing; it does not repeat the matrix. Manual dispatch cannot publish. The release driver compares PyPI hashes with the tested artifact and checks a clean public install. Users can then run it with `uvx metalist`, install it persistently with `uv tool install metalist`, or install it with `pip install metalist`.
 
 If `--input` is omitted, a file picker opens (when `tkinter` and its native `_tkinter` component are available).
 Notes tagged with `@implies` are converted into ontology rules and are not imported as notes. Legacy rules that are invalid under the current ontology grammar are reported and skipped while valid rules continue importing.

{metalist-0.7.5 → metalist-0.8.0}/README.md

@@ -12,6 +12,11 @@ A minimalist single-user note-taking app focused on server-side rendering (SSR),
 - Multi-tab search contexts with server-persisted scroll/search state (survives browser restarts)
 - Manual namespace backups/restores to a user-selected backup folder with retention controls
 
+## Changes in 0.8.0
+
+- Error diagnostics now record safe request IDs, exception types, and source locations through Loguru; full tracebacks are available only in authenticated encrypted logs.
+- Releases run the full cross-platform matrix once on the `main` push. The tag publishes those exact tested distributions without rerunning the matrix.
+
 ## Changes in 0.7.5
 
 - Unexpected API 500 errors now show the exception class and MetaList source line in the browser, without exposing note contents, exception messages, or local filesystem paths.
@@ -21,7 +26,7 @@ A minimalist single-user note-taking app focused on server-side rendering (SSR),
 
 - Updates use a private, checksum-verified uv release on Windows, macOS, and Linux. The updater does not execute a user-installed uv, and it revalidates both the cached official archive and extracted executable before each use.
 - The HTTPS listener retries one bodyless safe request after a transient backend reset, records final transport failures server-side, and never replays a mutation or request body.
-- Release CI builds one distribution pair, starts independent platform/Python, installed-update, browser-smoke, and browser-soak gates in parallel, and caches only hash- or lockfile-verified dependencies. Cross-platform runtime changes must pass branch CI before merge.
+- Release CI builds one distribution pair, starts independent platform/Python, installed-update, browser-smoke, and browser-soak gates in parallel, and caches only hash- or lockfile-verified dependencies.
 
 ## Changes in 0.7.3
 
@@ -320,9 +325,9 @@ This repo now packages itself under the PyPI distribution name `metalist`. Curre
 
 Recommended release path:
 1. In the existing PyPI project `metalist`, configure GitHub Trusted Publishing for `evolvingstuff/metalist` and the workflow file `.github/workflows/publish-pypi.yml`.
-2. Push the candidate commit to a branch and wait for the `Publish to PyPI` validation workflow to pass for that exact commit. GitHub-hosted Windows, macOS, and Linux runners install the built wheel and test application startup outside the source checkout on Python 3.10 through 3.14. Every matrix job also exercises the real `metalist update` path with uv, backups, interpreter preservation, and two-namespace restart against a local release index. The old-version fixture carries the candidate updater so this validates the mechanism being shipped; it does not retroactively fix older installed updaters. You do not need those operating systems locally. Archive verification also checks runtime files, including agent Markdown resources, against both the wheel and source distribution.
-3. Only after every required check passes, create and push the release tag for that same commit. Any intervening change requires a new validation run before tagging. Branch and pull-request runs validate without publishing.
-4. The tag workflow repeats validation and publishes the same artifacts tested by its full matrix. Manual publication also requires all checks to pass. Users can then run it with `uvx metalist`, install it persistently with `uv tool install metalist`, or install it with `pip install metalist`.
+2. Develop and review the candidate on a feature branch with focused checks. Merge it into `main` and push `main` once. This runs the full `Publish to PyPI` validation matrix for that exact commit. GitHub-hosted Windows, macOS, and Linux runners install the built wheel and test application startup outside the source checkout on Python 3.10 through 3.14. Every installed-package matrix job also exercises the real `metalist update` path with uv, backups, interpreter preservation, and two-namespace restart against a local release index. The old-version fixture carries the candidate updater so this validates the mechanism being shipped; it does not retroactively fix older installed updaters. You do not need those operating systems locally. Archive verification checks runtime files, including agent Markdown resources, against both the wheel and source distribution.
+3. Wait for the exact-commit main release matrix to pass, then run `.venv/bin/python scripts/release.py X.Y.Z` to create and push the tag. Any intervening change requires a new main validation run before tagging.
+4. The tag job independently verifies every main-job conclusion and reuses the wheel and source distribution from that run for GitHub Trusted Publishing; it does not repeat the matrix. Manual dispatch cannot publish. The release driver compares PyPI hashes with the tested artifact and checks a clean public install. Users can then run it with `uvx metalist`, install it persistently with `uv tool install metalist`, or install it with `pip install metalist`.
 
 If `--input` is omitted, a file picker opens (when `tkinter` and its native `_tkinter` component are available).
 Notes tagged with `@implies` are converted into ontology rules and are not imported as notes. Legacy rules that are invalid under the current ontology grammar are reported and skipped while valid rules continue importing.

{metalist-0.7.5 → metalist-0.8.0}/app/main.py

@@ -53,8 +53,11 @@ from app.services.namespace_switcher import open_or_launch_namespace
 from app.services.namespace_runtime_guard import start_namespace_runtime_guard
 from app.services.diagnostics import configure_process_diagnostics
 from app.services.diagnostics import allow_plaintext_diagnostics
+from app.services.diagnostics import log_unexpected_exception
 from app.services.diagnostics import start_asyncio_diagnostics
 from app.services.diagnostics import track_request
+from app.services.diagnostics import write_encrypted_exception_trace
+from app.security.sensitive_logging import traceback_frame_summary
 from app.api.request_auth import clear_auth_cookie
 from app.api.routes.notes import router as api2_router
 from app.api.routes.auth import router as api2_auth_router
@@ -103,13 +106,20 @@ class InterceptHandler(logging.Handler):
             frame = frame.f_back
             depth += 1
 
-        error_type = ""
-        if record.exc_info is not None:
-            error_type = f" error_type={record.exc_info[0].__name__}"
+        error_detail = ""
+        if record.exc_info is not None and record.exc_info[0] is not None:
+            error_detail = (
+                f" error_type={record.exc_info[0].__name__} "
+                f"frames={traceback_frame_summary(record.exc_info[2])}"
+            )
         logger.opt(depth=depth).log(
             level,
-            f"{record.getMessage()}{error_type}",
+            f"{record.getMessage()}{error_detail}",
         )
+        if record.exc_info is not None and record.exc_info[1] is not None:
+            write_encrypted_exception_trace(
+                context="standard logging", exception=record.exc_info[1], request_id="",
+            )
 
 
 logging.basicConfig(handlers=[InterceptHandler()], level=0, force=True)
@@ -153,11 +163,18 @@ async def handle_ontology_parse_error(request: Request, exc: OntologyParseError)
 
 @app.exception_handler(Exception)
 async def handle_unexpected_server_error(request: Request, exc: Exception):
+    request_id = request.scope.get("state", {}).get("diagnostic_request_id", "")
+    log_unexpected_exception(
+        context="HTTP request", exception=exc, request_id=request_id, level="ERROR",
+    )
+    diagnostic = describe_server_exception(exc)
+    if request_id:
+        diagnostic["requestId"] = request_id
     return JSONResponse(
         status_code=500,
         content={
             "detail": "Internal server error",
-            "diagnostic": describe_server_exception(exc),
+            "diagnostic": diagnostic,
         },
         headers={"Cache-Control": "no-store, private", "X-Content-Type-Options": "nosniff"},
     )
@@ -361,6 +378,7 @@ async def redirect_remote_http_to_https(request: Request, call_next):
 @app.middleware("http")
 async def log_requests(request: Request, call_next):
     request_id = uuid.uuid4().hex[:8]
+    request.state.diagnostic_request_id = request_id
     handler = request.scope.get("endpoint")
     handler_name = getattr(handler, "__qualname__", "unknown")
 

{metalist-0.7.5 → metalist-0.8.0}/app/services/content_formatting.py

@@ -328,7 +328,7 @@ def remove_formatting_scope_delimiters(
 def _is_removable_formatting_tag(token: str) -> bool:
     if not isinstance(token, str):
         raise TypeError(f"token must be a string, got {type(token)}")
-    if not token.startswith("@"):
+    if not token.startswith("@") or token == "@":
         return False
     tag_name = _canonical_meta_tag_name(token[1:].casefold())
     if tag_name in _REMOVABLE_FORMATTING_TAGS:
@@ -822,7 +822,7 @@ def _add_implied_meta_tags(*, tags: str, config: MetaTagConfig) -> MetaTagConfig
         implied_terms = ontology.infer_implication_only(base_tags=source_terms)
         implied_meta_tags: Set[str] = set()
         for term in implied_terms:
-            if not term.startswith("@"):
+            if not term.startswith("@") or term == "@":
                 continue
             tag_name = _canonical_meta_tag_name(term[1:].casefold())
             if _is_formatting_meta_tag_name(tag_name):
@@ -1230,7 +1230,7 @@ def _parse_meta_tags(tags: str) -> MetaTagConfig:
     for token in tokens:
         base, wrapper = _unwrap_tag_token(token)
         if wrapper is None:
-            if not base.startswith("@"):
+            if not base.startswith("@") or base == "@":
                 continue
             tag_name = _canonical_meta_tag_name(base[1:].casefold())
             if not _is_formatting_meta_tag_name(tag_name):
@@ -1248,7 +1248,7 @@ def _parse_meta_tags(tags: str) -> MetaTagConfig:
         key = (opener, depth)
         wrappers_to_consume.add(key)
         for inner in inner_tokens:
-            if not inner.startswith("@"):
+            if not inner.startswith("@") or inner == "@":
                 continue
             tag_name = _canonical_meta_tag_name(inner[1:].casefold())
             if not _is_formatting_meta_tag_name(tag_name):
@@ -1257,9 +1257,7 @@ def _parse_meta_tags(tags: str) -> MetaTagConfig:
                     if key in scoped_renderers:
                         existing = scoped_renderers[key]
                     if existing is not None and existing != tag_name:
-                        raise ValueError(
-                            f"Wrapper {key} has conflicting scoped renderers: {existing} vs {tag_name}"
-                        )
+                        continue
                     scoped_renderers[key] = tag_name
                 continue
             if key not in scoped:

{metalist-0.7.5 → metalist-0.8.0}/app/services/diagnostics.py

@@ -116,6 +116,42 @@ def authenticated_logging_is_active() -> bool:
     return _authenticated_logging_active
 
 
+def log_unexpected_exception(
+    *, context: str, exception: BaseException, request_id: str, level: str,
+) -> None:
+    """Keep plaintext diagnostics data-free; retain full traces in encrypted logs."""
+    if context == "":
+        raise ValueError("Exception context must not be empty")
+    if level not in {"ERROR", "CRITICAL"}:
+        raise ValueError(f"Unsupported unexpected-exception level: {level}")
+    logger.bind(request_id=request_id).log(
+        level,
+        "[diagnostics] unexpected {context} exception "
+        "error_type={error_type} frames={frames}",
+        context=context,
+        error_type=type(exception).__name__,
+        frames=traceback_frame_summary(exception.__traceback__),
+    )
+    write_encrypted_exception_trace(
+        context=context, exception=exception, request_id=request_id,
+    )
+
+
+def write_encrypted_exception_trace(
+    *, context: str, exception: BaseException, request_id: str,
+) -> None:
+    """Write exception messages only to the authenticated encrypted sink."""
+    with _authenticated_logging_lock:
+        if not _authenticated_logging_active:
+            return
+        if _authenticated_log_sink is None:
+            raise RuntimeError("Authenticated logging is active without an encrypted sink")
+        formatted = "".join(traceback.format_exception(exception))
+        _authenticated_log_sink.write(
+            f"[diagnostics] {context} request_id={request_id}\n{formatted}"
+        )
+
+
 def _disable_plaintext_fault_logging() -> None:
     if hasattr(signal, "SIGUSR1"):
         faulthandler.unregister(signal.SIGUSR1)
@@ -397,22 +433,20 @@ def _direct_append_log_recycler_loop() -> None:
 
 
 def _log_unhandled_exception(exc_type, exc_value, exc_traceback) -> None:
-    logger.critical(
-        "[diagnostics] unhandled process exception error_type={error_type} frames={frames}",
-        error_type=exc_type.__name__,
-        frames=traceback_frame_summary(exc_traceback),
+    log_unexpected_exception(
+        context="process", exception=exc_value, request_id="", level="CRITICAL",
     )
 
 
 def _log_unhandled_thread_exception(args: threading.ExceptHookArgs) -> None:
     if args.thread is None:
         raise RuntimeError("Thread exception hook missing thread")
-    logger.critical(
-        "[diagnostics] unhandled thread exception thread={thread_name} "
-        "error_type={error_type} frames={frames}",
-        thread_name=args.thread.name,
-        error_type=args.exc_type.__name__,
-        frames=traceback_frame_summary(args.exc_traceback),
+    exception = args.exc_value
+    if exception is None:
+        raise RuntimeError("Thread exception hook missing exception")
+    log_unexpected_exception(
+        context=f"thread {args.thread.name}", exception=exception,
+        request_id="", level="CRITICAL",
     )
 
 
@@ -475,13 +509,13 @@ class TrackedRequest:
             ended_at=time.perf_counter(),
         )
         if exc_type is not None:
-            logger.error(
-                "[diagnostics] request crashed request_id={request_id} "
-                "duration={duration:.2f} ms error_type={error_type} frames={frames}",
+            if exc is None:
+                raise RuntimeError("Tracked request exited with an exception type but no exception")
+            log_unexpected_exception(
+                context=f"request after {duration_ms:.2f} ms",
+                exception=exc,
                 request_id=self._request_id,
-                duration=duration_ms,
-                error_type=exc_type.__name__,
-                frames=traceback_frame_summary(exc_traceback),
+                level="ERROR",
             )
         return False
 
@@ -697,10 +731,8 @@ def _handle_asyncio_exception(
 ) -> None:
     exception = context.get("exception")
     if isinstance(exception, BaseException):
-        logger.error(
-            "[diagnostics] unhandled asyncio exception error_type={error_type} frames={frames}",
-            error_type=type(exception).__name__,
-            frames=traceback_frame_summary(exception.__traceback__),
+        log_unexpected_exception(
+            context="asyncio task", exception=exception, request_id="", level="ERROR",
         )
         return
     logger.error(

{metalist-0.7.5 → metalist-0.8.0}/app/static/js/modules/api-error-diagnostics.js

@@ -1,5 +1,6 @@
 const ERROR_TYPE = /^[A-Za-z_][A-Za-z0-9_]*$/;
 const CODE_LOCATION = /^(?:app(?:\/[A-Za-z_][A-Za-z0-9_]*)+\.py:\d+|external)$/;
+const REQUEST_ID = /^[a-f0-9]{8}$/;
 
 export async function describeApiFailure(response) {
     const base = `API call failed: ${response.status} ${response.statusText}`;
@@ -12,5 +13,8 @@ export async function describeApiFailure(response) {
     if (!ERROR_TYPE.test(diagnostic?.errorType) || !CODE_LOCATION.test(diagnostic?.codeLocation)) {
         return base;
     }
-    return `${base} (${diagnostic.errorType} at ${diagnostic.codeLocation})`;
+    const requestId = REQUEST_ID.test(diagnostic.requestId)
+        ? `, request ${diagnostic.requestId}`
+        : '';
+    return `${base} (${diagnostic.errorType} at ${diagnostic.codeLocation}${requestId})`;
 }

{metalist-0.7.5 → metalist-0.8.0}/app/static/js/modules/mode-manager/services/tag-syntax-service.js

@@ -28,6 +28,28 @@ const TAG_WRAPPER_PAIRS = new Map([
     ['(', ')'],
 ]);
 const TAG_WRAPPER_CHARS = new Set(['[', ']', '{', '}', '(', ')']);
+const SCOPED_RENDERER_TAGS = new Set(['@markdown', '@latex', '@json', '@csv', '@shell']);
+const KNOWN_META_TAGS = new Set([
+    '@footnote', '@monospace', '@heading', '@red', '@green', '@blue', '@grey',
+    '@highlighter', '@bold', '@italic', '@strikethrough', '@serif', '@copyable',
+    '@list-bulleted', '@list-numbered', '@username', '@password', '@email',
+    '@todo', '@done', '@markdown', '@llm', '@latex', '@shell', '@json', '@csv',
+]);
+
+function isSupportedMetaTag(term) {
+    if (typeof term !== 'string') {
+        throw new Error('isSupportedMetaTag requires string');
+    }
+    if (!term.startsWith('@')) {
+        return true;
+    }
+    const folded = term.toLowerCase();
+    if (KNOWN_META_TAGS.has(folded)) {
+        return true;
+    }
+    return /^@size=(?:\d+(?:\.\d*)?|\.\d+)$/.test(folded)
+        && /[1-9]/.test(folded.slice('@size='.length));
+}
 
 function isAsciiPrintable(char) {
     if (typeof char !== 'string' || char.length === 0) {
@@ -515,8 +537,10 @@ export function analyzeTagBarInput(rawInput) {
 
     const sanitizedSegments = [];
     const normalizedSegments = [];
+    let globalRenderer = null;
     for (const segment of segments) {
         normalizedSegments.push(segment.text);
+        let sanitizedToken = segment.text;
         if (segment.type === 'token') {
             const wrapperInfo = analyzeUnclosedWrapperTokenInfo(segment.text);
             if (wrapperInfo) {
@@ -530,8 +554,42 @@ export function analyzeTagBarInput(rawInput) {
                 hasReservedOrTag = true;
                 continue;
             }
+            if (closedWrapperInfo) {
+                let scopedRenderer = null;
+                const retainedTerms = tagTerms.filter((term) => {
+                    if (!isSupportedMetaTag(term)) {
+                        return false;
+                    }
+                    const renderer = term.toLowerCase();
+                    if (!SCOPED_RENDERER_TAGS.has(renderer)) {
+                        return true;
+                    }
+                    if (scopedRenderer !== null && scopedRenderer !== renderer) {
+                        return false;
+                    }
+                    scopedRenderer = renderer;
+                    return true;
+                });
+                if (retainedTerms.length === 0) {
+                    continue;
+                }
+                const opener = segment.text[0];
+                const prefix = opener.repeat(closedWrapperInfo.depth);
+                const suffix = TAG_WRAPPER_PAIRS.get(opener).repeat(closedWrapperInfo.depth);
+                sanitizedToken = `${prefix}${retainedTerms.join(' ')}${suffix}`;
+            } else if (!isSupportedMetaTag(segment.text)) {
+                continue;
+            } else {
+                const renderer = segment.text.toLowerCase();
+                if (SCOPED_RENDERER_TAGS.has(renderer)) {
+                    if (globalRenderer !== null && globalRenderer !== renderer) {
+                        continue;
+                    }
+                    globalRenderer = renderer;
+                }
+            }
         }
-        sanitizedSegments.push(segment.text);
+        sanitizedSegments.push(sanitizedToken);
     }
 
     const sanitizedText = sanitizedSegments.join(' ').trim();

{metalist-0.7.5 → metalist-0.8.0}/app/version.py

@@ -1,3 +1,3 @@
 """Single authoritative MetaList application version."""
 
-__version__ = "0.7.5"
+__version__ = "0.8.0"

{metalist-0.7.5 → metalist-0.8.0/metalist.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: metalist
-Version: 0.7.5
+Version: 0.8.0
 Summary: A minimalist single-user note-taking app with SSR, fast in-memory tree operations, and efficient sync.
 Project-URL: Homepage, https://github.com/evolvingstuff/metalist
 Project-URL: Repository, https://github.com/evolvingstuff/metalist
@@ -48,6 +48,11 @@ A minimalist single-user note-taking app focused on server-side rendering (SSR),
 - Multi-tab search contexts with server-persisted scroll/search state (survives browser restarts)
 - Manual namespace backups/restores to a user-selected backup folder with retention controls
 
+## Changes in 0.8.0
+
+- Error diagnostics now record safe request IDs, exception types, and source locations through Loguru; full tracebacks are available only in authenticated encrypted logs.
+- Releases run the full cross-platform matrix once on the `main` push. The tag publishes those exact tested distributions without rerunning the matrix.
+
 ## Changes in 0.7.5
 
 - Unexpected API 500 errors now show the exception class and MetaList source line in the browser, without exposing note contents, exception messages, or local filesystem paths.
@@ -57,7 +62,7 @@ A minimalist single-user note-taking app focused on server-side rendering (SSR),
 
 - Updates use a private, checksum-verified uv release on Windows, macOS, and Linux. The updater does not execute a user-installed uv, and it revalidates both the cached official archive and extracted executable before each use.
 - The HTTPS listener retries one bodyless safe request after a transient backend reset, records final transport failures server-side, and never replays a mutation or request body.
-- Release CI builds one distribution pair, starts independent platform/Python, installed-update, browser-smoke, and browser-soak gates in parallel, and caches only hash- or lockfile-verified dependencies. Cross-platform runtime changes must pass branch CI before merge.
+- Release CI builds one distribution pair, starts independent platform/Python, installed-update, browser-smoke, and browser-soak gates in parallel, and caches only hash- or lockfile-verified dependencies.
 
 ## Changes in 0.7.3
 
@@ -356,9 +361,9 @@ This repo now packages itself under the PyPI distribution name `metalist`. Curre
 
 Recommended release path:
 1. In the existing PyPI project `metalist`, configure GitHub Trusted Publishing for `evolvingstuff/metalist` and the workflow file `.github/workflows/publish-pypi.yml`.
-2. Push the candidate commit to a branch and wait for the `Publish to PyPI` validation workflow to pass for that exact commit. GitHub-hosted Windows, macOS, and Linux runners install the built wheel and test application startup outside the source checkout on Python 3.10 through 3.14. Every matrix job also exercises the real `metalist update` path with uv, backups, interpreter preservation, and two-namespace restart against a local release index. The old-version fixture carries the candidate updater so this validates the mechanism being shipped; it does not retroactively fix older installed updaters. You do not need those operating systems locally. Archive verification also checks runtime files, including agent Markdown resources, against both the wheel and source distribution.
-3. Only after every required check passes, create and push the release tag for that same commit. Any intervening change requires a new validation run before tagging. Branch and pull-request runs validate without publishing.
-4. The tag workflow repeats validation and publishes the same artifacts tested by its full matrix. Manual publication also requires all checks to pass. Users can then run it with `uvx metalist`, install it persistently with `uv tool install metalist`, or install it with `pip install metalist`.
+2. Develop and review the candidate on a feature branch with focused checks. Merge it into `main` and push `main` once. This runs the full `Publish to PyPI` validation matrix for that exact commit. GitHub-hosted Windows, macOS, and Linux runners install the built wheel and test application startup outside the source checkout on Python 3.10 through 3.14. Every installed-package matrix job also exercises the real `metalist update` path with uv, backups, interpreter preservation, and two-namespace restart against a local release index. The old-version fixture carries the candidate updater so this validates the mechanism being shipped; it does not retroactively fix older installed updaters. You do not need those operating systems locally. Archive verification checks runtime files, including agent Markdown resources, against both the wheel and source distribution.
+3. Wait for the exact-commit main release matrix to pass, then run `.venv/bin/python scripts/release.py X.Y.Z` to create and push the tag. Any intervening change requires a new main validation run before tagging.
+4. The tag job independently verifies every main-job conclusion and reuses the wheel and source distribution from that run for GitHub Trusted Publishing; it does not repeat the matrix. Manual dispatch cannot publish. The release driver compares PyPI hashes with the tested artifact and checks a clean public install. Users can then run it with `uvx metalist`, install it persistently with `uv tool install metalist`, or install it with `pip install metalist`.
 
 If `--input` is omitted, a file picker opens (when `tkinter` and its native `_tkinter` component are available).
 Notes tagged with `@implies` are converted into ontology rules and are not imported as notes. Legacy rules that are invalid under the current ontology grammar are reported and skipped while valid rules continue importing.