ceremony/CHANGELOG.md

Changelog

The curated history of the ceremony itself. Each release's section is published verbatim as that release's body (lib/changelog.sh extracts it), so entries say what changed, cite the issue, and stop — at most 300 characters each, guard-enforced on the PR that writes the fragment (#167); a genuinely long change ships several short entries, never one long one. The citation is guard-enforced too, and it closes the entry: one (#N) group, then the final . and nothing after it (#262). Sections published before that rule keep their prose; the guard reads fragments only. Entries arrive as fragments — one changelog.d/<issue>.md per PR, never an edit to this file — and the release PR assembles them into the next section here (bin/changelog-assemble, #112).

This tree is heavy-duty/ceremony on forgejo.heavyduty.builders, and it tracks the upstream tree's version numbers (#197 D2). Two trees therefore answer to the same number, differing by the forge-compatibility delta. This tree carries upstream through 8c3a4d1 (upstream 0.6.0, merged by #198); the 0.4.1 section below is this forge's own release, not upstream's, and upstream's separate 0.4.1 section is deliberately not carried — the tag published here is the one this section is the body of. Each sync updates this line (docs/UPSTREAM-SYNC.md, #200).

0.6.0 — 2026-08-05

Added

• The issue-flow sweep's claimed-branch ruling pre-read is pinned: an unassigned claim under needs-ruling must draw its board diagnostic and its ruling nudge in one sweep, so a read that drifts below the diagnostic reds instead of silently costing the escalation 7 days (#284, #307).
• The issue-flow sweep now flags a collision the board never declared: two open, unblocked issues whose titles name one deliverable draw a comment naming the newer's owed Blocked by edge. Keys normalize, so actions/x and x are one deliverable (#288).
• The sweep now flags an unblocked non-member during a standing release window, naming the window's invariant. claimed counts, PR in flight or not. The gate is read from the release issue's own Blocked by declarations, and an emptied gate leaves it dormant (#292).
• Both flags are advisory: comments only, no label write and no state change, deduped against each family's last word on the thread so a standing state re-sweeps silently (#293).
• The fragment guard now requires each entry to end with its issue citation: one (#N) group — local, repo#N or owner/repo#N references separated by , — then the final . and nothing after it (#262).
• The refusal distinguishes an entry carrying no reference at all from one whose reference is present but not terminal, and names the shape to write in both (#262).
• The 300-character bound still outranks the citation across the whole fragment, and the outranked problem stays out of the message it lost to: one fragment, one diagnosis, wherever in the file it sits (#262).
• BUILDER.md now describes a fix round that rides a draft: the draft phase stays the builder's, ready-for-review is the builder's own act, and where a draft suppressed the checks green is proven at the flip (#258).
• REVIEWER.md now reads a draft carrying state:addressing as a fix round in progress rather than abandonment (#258).
• A post-merge item with no comment for 7 days now draws one nudge from the issue sweep: the wake evidence is owed. A starving criterion used to be found only when someone happened to run the right read (#254).
• Label churn does not reset that clock, and neither does an assignment: on post-merge an assignee is an invalid composition, not activity, and it must not buy the item another 7 days of silence (#254).
• The nudge names the triage actor from triage-actors=, not the human reviewer: post-merge is triage's completion queue, so the starved wake condition is triage's to answer (#254).
• It links the item and parses nothing from the body — which criterion starved is prose, and the machine never judges prose (#254).
• Like the ruling nudge it carries no idempotency marker on purpose: the comment is itself activity, so the rule self-rate-limits to one nudge per 7 quiet days. Comment-only — no path here writes a label (#254).
• Release epics now announce release initialization when their declared dependency gates clear (#253).
• The issue sweep now echoes an issue's parsed Blocked by set as a comment whenever that set changes, so a readable-but-wrong declaration is visible in one sweep instead of days later, when a human happens to run the parser by hand (#252).
• The echo's marker carries the parsed set itself: an unchanged parse never re-posts on a 15-minute cron, and a changed one always speaks. Comment-only — no path here writes a label (#252).
• CI now refuses a root *.md declared in neither docs/VENDORED.txt nor the guard's short exemption list, so a new doctrine file can no longer reach a tag undeclared and stay invisible to every consumer's docs-sync (#251).
• The same guard reads the manifest the other way: every entry must resolve to a regular, non-empty, tracked file — no symlink, no directory, no ../ escape (#251).
• Document the optional, operator-ruled release-epic flow for governed repositories. (#248).
• Guard documentation availability markers against missing issue citations and release candidates that already ship the cited work (#238).
• The label and issue-flow sweeps now comment once per episode when attention targets a pull request or an unassigned issue, without retargeting the demand or changing labels or assignees (#232).
• Pull requests that promise Refs #N now fail a read-only, body-edit-aware guard if GitHub would close N through a keyword or sidebar link (#218).

Changed

• README.md is rewritten whole from the current tree: the front page names the governance repo ceremony now is, routes to docs/CONSUMERS.md, AGENTS.md, LABELS.md and RELEASES.md rather than restating them, and keeps the operator's release runbook as its core, re-measured (#311).
• Standing release windows are dependency DAGs: every mint is placed in the window or behind it, and only current sources are ready (#292).
• TRIAGE.md now requires unconditional collision-edge chains when open issues carry the same deliverable, keeping the ready queue concurrently claimable (#288).
• TRIAGE.md now states its rules with bare record cites: the label-race and lifted-hold incident narratives leave the normative text while their operational rules remain complete (#282).
• BUILDER.md states its rules and cites their record bare: the incident narratives, the links into issue comments and the cross-repo issue cites leave the normative text, which no rule leaves with them (#281).
• CONTRIBUTING.md now keeps vendored doctrine self-contained: state the rule, retain at most one sentence of why, cite the local record bare, and leave the incident narrative in that record (#280).
• BUILDER.md's green ruled term now says which entry to read before it says what an entry means: a check's word at a head is its newest entry by start time, and a cancelled entry is not that word while the same check carries a non-cancelled one at that head (#276).
• A check whose every entry at the head is cancelled is unchanged — nothing survived to be its word, so it never reported and is not green — and the collapse mirrors checks_state's carve-out rather than adding a class (#276).
• BUILDER.md's step 1 now rules the checkless head: no checks configured is nothing to wait for, and the request goes out straight away — stated once, in the ruled-term paragraph, with the draft-round restatement removed (#272).
• README.md and RELEASES.md derive scope:docs, and the changelog-assembled, docs-sync and runner-isolated actions and tests derive scope:guards; all five were mapped nowhere. The docs block matched a literal README, which this tree does not carry (#267).
• lib/read.sh and lib/ruling.sh derive scope:labels beside scope:release-flow. Both reconcilers share them, and a mixed file wears both labels rather than lib/** being re-carved into a row per file (#267).
• TRIAGE.md now tells every epic author to put its progress checklist under the literal ## Task list heading, because any other heading is silently invisible to the completion sweep (#266).
• TRIAGE.md now scopes the no-assignee board bug to flagging an unassigned issue, while still directing triage to repair ownership instead (#264).
• BUILDER.md and CHANGELOG.md state the citation as guard-enforced rather than as house style, beside the 300-character bound it now sits next to (#262).
• Four fragments in flight gained a terminal citation; published sections are untouched, so no shipped prose is re-opened (#262).
• BUILDER.md's green ruled term now names its field: greenness is read from each check's conclusion, never its status, and stale means a check of a superseded head — not a same-head node whose status lags its own conclusion (#260).
• Consumer guidance: re-vendor tooling reads the pin's docs/VENDORED.txt, never a hardcoded list, so a new doctrine file propagates at the next ordinary pin bump with zero list edits (#251).
• Define the doors-unchanged drill record and an executable release-path list, so a release may reuse live evidence only when its door bytes are unchanged since the last rehearsed tag (#237).

Fixed

• A roster edit no longer reds the whole suite: the labels-reconcile state-machine fixtures name their own panel instead of binding .github/labels.conf by slot (#304).
• Shrinking panel= to three had left that binding's third slot unbound, and set -u aborted the file before its first assertion — 217 assertions became 0, on main and on every branch cut from it (#304).
• The one case still reading the shipped roster asserts a property, not a size: it parses, and each member is recused from its own panel. Any panel= of one or more members leaves test/run.sh green (#304).
• lib/attention.sh locates as label machinery beside its two shelf-mates — [scope:release-flow] alone was a wrong answer of the class #267 measured — and the map learns the sweep workflow pair, the shared-lib tests, and seven enumerated test/guard surfaces (#302).
• Claiming a needs-ruling issue no longer buys its escalation another 7 quiet days: the issue-side ruling clock reads comments alone — an assignment is the claim clock's fact — and LABELS.md now names what each surface's clock reads (#284).
• scope:release-flow no longer rides every pull request: changelog.d/** is out of its path map. Doctrine makes every behavior change write a fragment, so the glob labelled 20 of the last 20 PRs while 3 touched a release surface. CHANGELOG.md stays, as only the release PR edits it (#267).
• The issue-flow reconciler and its test now derive scope:labels, the scope that already names the taxonomy they reconcile (#267).
• Abort issue-flow reconciliation when the board read fails instead of reporting a complete pass over an empty or partial result (#257).
• The issue sweep no longer derives label writes from a read that failed. An HTTP 504 whose body is GitHub's JSON error object passed every guard and emptied the label set, so a healthy epic was written needs-triage and the pass reported success (#247).
• A failed comments read no longer reclaims a live claim. Swallowed, it dated the issue by created_at and unassigned the builder under a comment asserting 48 hours of silence about an issue commented on seconds earlier (#247).
• A failed comments read no longer reads as "no marker", which re-posted the comment the marker exists to suppress (#247).
• Every read inside the per-issue subshell is checked explicitly, on its status and on its payload shape; the issue is left exactly as it is and the sweep continues. A partial pass names its skipped issues after reconciled. (#247).
• A per-issue pass is now atomic: its writes and its log lines commit only once the pass completes. A skip could previously land after an earlier mutation, reporting an issue as untouched when a label had already been written or removed (#247).
• The issue-flow sweep now reads an issue's deliverable as the Refs PR that merged last, not the one numbered highest — merge order is not number order, and the old rule spent the transition marker on the wrong PR (#242).
• Preserve active claims when an open local pull request links them with Refs #N. (#241).
• blocker:unrequested no longer fires while a head's checks are pending or red: the review round forbids requesting there, so the one blocker that demanded an act flagged builders for complying. Pending is CI's move, red is blocker:ci-red's (#236).
• blocker:unrequested now waits for the round to settle — the head and the newest verdict must have stood for RECONCILE_UNREQUESTED_GRACE (default 300s) — so a sweep landing between a push and its re-request no longer flags a round in motion (#236).
• LABELS.md no longer claims nothing in actions/ clears or reads attention: the reconciler has done both since the derived claimed → post-merge transition shipped. The amended text keeps the hand-set rule and admits the one clear and the diagnostic read (#231).
• Triage now puts attention on the assigned issue that owns a claim, never on its pull request, and treats an unassigned issue as a board bug rather than a demand (#230).

0.5.0 — 2026-08-03

Added

• labels.conf accepts optional panel[<login>]= rows: the required set for a PR authored by that login is the row minus the author; other authors keep panel=. Consumers gain the row at their next pin bump — adding it before that bump is a parse failure that takes the label board down (#224).

Changed

• Doctrine: third-party actions never hold a write-capable token by default — repo-owned scripts in write-capable jobs, established publisher plus full-SHA pin for the exception, SHA pins everywhere. Canonical in REVIEWER.md, short form in BUILDER.md; consumers adopt at the pin bump (#216).

Fixed

• ruling_escalation_row selects the setter's best-shaped in-window comment, ties broken to the earliest, instead of the earliest outright — a whole-round reply landing seconds before the escalation is no longer graded in its place (crew#293).
• The escalation selector and ruling_shape_decision share one field-presence matcher, and an undecodable body column scores 0 instead of erroring the sweep.
• Five stale unreleased markers in docs/CONSUMERS.md now name their tags: fragment mode, changelog-assembled and runner-isolated at 0.2.0; the additive labeler at 0.3.0; the two-caller split at 0.4.1 (#221).
• The marker convention now names its clearing owner: the release PR that ships machinery clears, in that same PR, every marker its assembled section makes false (#221).
• A standing non-approving verdict now outranks draft in decide_state: a re-drafted PR mid-round reads state:addressing, a live panel request on a draft surfaces as state:bots-reviewing, and a draft with no round history still reads state:building (#205).

0.4.1 — 2026-08-04

Added

• forge_release_exists, forge_commit_pulls, forge_tag_create, forge_release_create and forge_pr_create on both backends, so the release path names no client (#191).

• The forgejo backend serves one PR object at /commits/{sha}/pull where GitHub serves an array at /pulls; both verbs emit the array shape, so the call site carries one expression (#191).

• Forgejo creates tags at POST /tags — it serves /git/refs GET-only, so GitHub's ref-POST would have 404'd there forever (#191).

• forgejo_api_base refuses when REPO is empty. Every verb interpolates it and every call reaches the network through there, so repos//… — whose 404 reads as "no release" and "no PRs" — is now impossible (#191).

• Release asset names are percent-encoded. The hook contract permits any filename, and the name travels as a query value: a space made curl reject the URL and &/#/+/% silently renamed the asset (#191).

• lib/forge.sh — the forge selector: forge_detect names the forge from the runner's own environment, forge_client names the client it needs, and forge_preflight refuses loudly before any sweep when the two disagree (#188).

• The reconcilers and labels-scope run that preflight first, so a GitHub-shaped client on a Forgejo instance is a named refusal instead of a sweep that reads nothing and reports success (#188).

• lib/closes_references.sh — the closing-keyword parser, sibling of refs_references, so "which issues does this PR close" is answered from a PR body rather than from GitHub's GraphQL API (#188).

• lib/forge-github.sh and lib/forge-forgejo.sh — one call surface, two backends, selected by forge_select; no forge branching at the call sites (#188).

• The forgejo backend proves each paginated gather complete against the server's x-total-count and refuses loudly when it cannot — a missing header is a refusal, not a pass (#188).

Changed

• docs/CONSUMERS.md's artifact-hook recovery no longer tells operators to run gh release create by hand — on a Forgejo runner there is no gh. It names the forge-neutral tag-door path first, with both clients shown (#191).

• issueflow-reconcile gathers open and merged PRs over REST instead of gh api graphql. Forgejo serves no GraphQL at all, so the two queries were replaced rather than translated; both forges return number and body from /pulls in the same shape (#188).

• forge_api owns the page size, because each forge silently ignores the other's parameter: per_page=100 reads 30 items on Forgejo and limit=100 reads 30 on GitHub, both HTTP 200. No call site names one (#188).

• Outstanding review requests are derived from the reviews on the current head rather than from requested_reviewers, which Forgejo never clears — read raw there, a PR would sit at state:bots-reviewing forever (#188).

Fixed

• The release doors run on a Forgejo consumer. lib/facts.sh and release.yml gathered and published through gh, which the runner image does not ship, so the merge door read labeled=no for a correctly labeled ceremony PR and the tag door died at the publish (#191).

• A release fact that could not be read is no longer reported as a definite no. A completed read finding no label is still no and still fail-closed; a read that did not complete refuses and emits no fact (#191).

• labels-scope no longer fails to compile its jq program on jq 1.6, which the Forgejo runner image ships: label is a reserved word in jq's grammar, so $label is a syntax error there and every scope derivation died before reading the config (#188).

• labels-reconcile and labels-scope no longer exit 0 on a Forgejo consumer having read zero facts — measured on heavy-duty/rig, where the sweep printed reconciled. over an empty PR list and scope reported "no labeler.yml" for a file that exists (#188).

• forge_timeline projects Forgejo's label events (.type / .body / .user.login) into the GitHub shape (.event / .actor.login) so the ruling ladder reads the same board on both forges (#188).

• forge_pr_activity no longer calls /pulls/{n}/comments on Forgejo (HTTP 404); inline review comments come from reviews with comments_count > 0 (#188).

• CI installs shellcheck before linting, matching actionlint — the Forgejo runner image does not ship it (#188).

0.4.0 — 2026-07-29

Added

• changelog.d/shape — an optional one-line sentinel, flat or grouped, that pins the fragment set's shape and outranks the newest-published-section inference; absent, the inference binds unchanged (#182).
• Add post-merge issue state for merged Refs work awaiting triage-owned verification.
• changelog_fragment_problem bounds every entry at 300 normalized characters, red on the PR that writes the fragment; the armed guard and the assembler inherit the one definition (#167).
• BUILDER.md and CHANGELOG.md state the bound and the split rule: a long change ships several short entries, never one long one (#167).

Changed

• Labels automation docs now make sweep cadence a consumer-owned tradeoff, retain hourly as the engine-less default, and document manual dispatch as the operator's immediate full-board sweep (#203).
• labels — the reconcile cron relaxes from */15 to hourly (#199), cutting a private consumer's schedule-triggered full-board sweeps ~4× at GitHub's 1-minute billing floor.
• labels — the hourly cron is the sweep's only wake for transitions no subscribed event carries — a verdict landing, blocker:ci-red, a blocker:conflict when another PR merges, the time-based stale/reclaim — so it bounds their latency to ≤1h, delaying no event-carried transition (#199).
• labels — the caller's issues: trigger narrows to [opened, closed, edited, reopened] (#199), the actions that carry a queue-state change the cron cannot wait a cadence for. The churn/validation actions — labeled/unlabeled/assigned/unassigned — come off; the PR handoff wake is unaffected.
• labels — each caller trigger now carries a comment saying why it is subscribed, and reconcile keeps cancel-in-progress: false (#199) — cancelling a sweep mid-board is the race that guard exists to prevent.
• CONTRIBUTING.md now points to BUILDER.md for the shared PR flow instead of restating doctrine that can drift, while retaining ceremony's roster and other repo-specific facts (#198).
• Builder doctrine makes each whole-round reply the durable Round log record mirrored by the engine, leaving handoff as a mechanical facts-only step instead of a newly composed summary (#196).
• FLEET.md removes its duplicate bench roster, records crew as a general operator-configured tool, and advances its whole-file audit stamp to crew@eaeb302 with every surviving crew link re-pinned (#193).
• FLEET.md keeps the registry's authorization rule and its crew#16/crew#66 provenance, while replacing duplicated mechanism and path claims with a pinned pointer to crew's registry header (#192).
• BUILDER.md gates both review-request points on a green check at the head, carries crew#45's argued exception for failures outside the PR, and states the ruled classification: cancelled and stale are not a green head; skipped and neutral are (#189).
• BUILDER.md documents CI-red recovery in pickup precedence: a red head of your own PR is picked up before claiming another issue, is never a parked claim, and follows crew#17's recovery path (#189).
• FLEET.md writes the ci-red wake into the duty order between resume and build, now as deployed engine rather than on paper: the reconciliation stamp advances to the crew SHA carrying crew#64 (#189).
• FLEET.md describes the build wake's check gate as the engine implements it: a green head, or one with no checks configured, opens a round; a red head and an unfinished one are held and reported separately (#189).
• FLEET.md corrects the attention wake to the crew#66 ruling: the query is cross-repo, the action is registry-bounded, and an out-of-scope demand is reported and escalated to the operator rather than worked. It no longer claims attention is exempt from the registry (#189).
• FLEET.md distinguishes an attention session that dies before acking, which relaunches, from one that completes without acking, which is a decline a ledger keeps from re-firing (#189).
• BUILDER.md re-requests by head, not by verdict: a push while answering a round stales every approval, so every panelist is re-requested; only an unchanged head re-requests the non-approvers alone (#190).
• FLEET.md's duty-loop mechanism is a pointer to crew's shared engine; the wake lists follow the engine's duty order, the roster keeps the as-built bench beside fleet.roster's target, and the reconciliation stamp names crew@01fb49c (#187).
• Ceremony's changelog is grouped from this release forward: the pending fragments carry ### headings under a grouped sentinel (#182).
• BUILDER.md: a park declaration stands until its facts change — a nothing-changed resumption posts nothing; only a no-open-PR park owes a refresh, inside the 48-hour reclaim window (#178).
• Private-repository label callers document actions: read alongside checks and statuses for workflow-run check-rollup nodes (#173).

Fixed

• FLEET.md no longer says a review request outside the registry is authorization: repos.txt is the scope for the review queue, out-of-scope requests are logged and never acted on, and the attention wake is stated as the one registry-independent exception, by design (#187).
• blocked_reference_records unions every Blocked by clause in the body instead of binding to the first marker occurrence — a repeated declaration no longer promotes on its first sentence alone, and earlier prose that merely mentions being blocked no longer hijacks the parse (#184).
• decide_state() refuses state:needs-human while the hand-set blocked label stands — the PR falls to state:addressing, exactly parallel to the needs-ruling exclusion; never emitted by blockers() (#180).

0.3.0 — 2026-07-24

• Make changelog-armed reject fragment shape drift on the PR that introduces it.
• A directive hold now has a written ending, not just a beginning: BUILDER.md's shape 5 says the hold ends where it began — on the labels — with the hold owner's most recent queue-label event governing over any stale prose, the timeline read (gh api .../issues/{n}/timeline) named as the move before standing down or up on a hold, a claim against stale prose required to cite the events it read, and a refused claim given its two exits. TRIAGE.md now requires re-reading label events before asserting label-borne state in prose, and makes correcting a lifted hold's stale body header triage's move in the same tick. On 2026-07-24 the unranked signals split two builders reading one board (#149, #151); both acted defensibly — the doctrine, not the builders, lacked the rule (#154).
• Doctrine names the second Closes #N exception: a same-repo PR whose authorizing issue marks an acceptance criterion post-merge uses Refs #N, and triage closes the issue by hand on the evidence — merging #143 auto-closed #137 with exactly such a criterion unmet, and no role had been told otherwise. TRIAGE.md now requires a post-merge criterion to carry its own mechanism (post-merge, triage closes, Refs #N), REVIEWER.md lists Refs #N beside Closes #N and Part of <owner>/<repo>#N and stops treating the reference-only PR as a defect, and CONTRIBUTING.md points at BUILDER.md as the rule's one home (#151).
• FLEET.md — the Reviewers wake describes the deployed sweep, not the gh search trigger the bench replaced: the pulls-API requested_reviewers sweep across the org plus the named bot forks is source 1, the repos.txt/search poll an adds-only backstop, and the two are merged and deduplicated by (repo, PR) before acting. Only the notifier's needs-ruling queue remains on paper; repos.txt is the registry only on the triage box; and the Status block now stamps the crew ref the file was last reconciled against (#149).
• REVIEWER.md now carries the review mechanics every box had been re-deriving from an incident: the queue comes from the API and not the search index, every write is one-shot per (reviewer, PR, head), heads are reviewed in throwaway checkouts, a pinned consumer's config is verified at its pin, and a verdict names the checks its box could not run (#145).
• The docs/CONSUMERS.md labels-caller stub lists the same issues: types as ceremony's own caller — edited and reopened included — so a consumer adopting the stub wakes when an issue body's Blocked by #N declaration is edited, and when a closed issue re-enters the queue wearing labels derived at close. The two lists drifted apart inside PR #32; a parity test now pins them together, red if either file drops a type or the lists diverge. Adopting the widened list is a stub edit riding the pin bump to the first tag carrying this change (#144).
• labels-reconcile — a queue-cancelled duplicate check is discarded when its context holds a real verdict, so a sibling PR's eviction no longer reds a green PR; an all-cancelled context still blocks (#139).
• blocker:unrequested now clears the moment the panel is asked: the labels caller (and the docs/CONSUMERS.md stub) listens on review_requested and review_request_removed, so the one event that falsifies the label — or makes it true again — wakes the reconcile sweep instead of waiting for an unrelated push or the advisory cron. The scope job skips both events: they change no paths, and running the labeler on them widens the #130 clobber window. Adopting the new triggers is a stub edit riding the pin bump to the first tag carrying this change (#137).
• drills/README.md no longer tells the builder to delete the scratch repo — a step no fleet identity can perform, because delete_repo is deliberately absent from bot tokens. The builder's end state is archive (archived: true, inside the repo scope); the delete is the operator's, and cleanup gates nothing — not ready-for-review, not the panel, not the merge. The drill record now names the scratch repo by owner/name and states the disposal its author actually observed, never one that has not happened: both 0.2.0 drills hit the missing-scope wall independently, one stalling a release draft on an impossible 403, the other shipping a record asserting a delete that never ran (#135).
• lib/facts.sh — a repository's first push to main (a root commit with no first parent) now reads base_ver=(none) and lets decide's table govern, instead of dying at exit 128 before establishing a fact; the no-base path skips the base fetch and git show, and an unresolvable head still fails loudly (#134).
• The changelog rule now explains why release PRs write no fragment and how entry-worthy changes land instead (#131).
• actions/labels-scope replaces actions/labeler@v5 in the labels workflow's scope job: labeler wrote the whole label set (PUT) even under sync-labels: false, silently removing any label applied while it ran — #128 lost its release that way — so the scope job now derives from the same .github/labeler.yml mapping (the changed-files/any-glob-to-any-file shape, block or flow; anything else refuses loudly) and its only write is an additive POST. The reconcile sweep also warns — never sets — when a non-draft PR is release-shaped (bare version differing from its base) but carries no release label (#130).

0.2.0 — 2026-07-24

• test/changelog-assembled.test.sh — keep the trio interaction aligned with fragment mode: a dropped entry makes armed red too, while a hand-edited section leaves assembled as the sole red (#126).
• actions/changelog-assembled — a release PR's stamped section must be byte-for-byte what the fragments it consumed assemble to, replayed from the merge base; inapplicable trees pass with a NOTICE (#116).
• changelog-armed — treat changelog.d/ as the arming, validate every development fragment, and require bare releases to consume the directory into their exact publishable section (#115).
• lib/changelog.sh + bin/changelog-assemble — read the changelog.d/ fragments, assemble one release section (canonical group order, one shape per repo), and consume exactly what was published (#114).
• BUILDER.md — the directed hold is the parked claim's fifth shape, its attention demand is acknowledged in the declaration comment, and its board bookkeeping covers in-flight work; TRIAGE.md no longer excludes it (#113).
• Ceremony adopts changelog.d/ — a PR writes one fragment per issue instead of editing CHANGELOG.md, the release PR assembles the section, and ## Unreleased is gone (#112).
• BUILDER.md — the handed-off PR is the parked claim's fourth shape, its handoff is its declaration, and shape 2 covers the round awaiting its first verdicts (#109).
• labels-reconcile — warn once per sweep when a repository lacks labels declared by the pinned core taxonomy (#105).
• LABELS.md — drop the vendored scope-table enumeration; the per-repo set lives in .github/labels.conf and the repo's own CONTRIBUTING (#104).
• labels-reconcile — a degraded mergeability/checks read now logs gh's actual stderr (collapsed, bounded) beside the byte-identical counted line, and the blind-sweep warning leads with the observed reason instead of asserting the permissions cause (#101).
• Changelog publication — count entries instead of bytes, refuse dangling grouped headings, and seed grouped re-arms with Added/Changed/Fixed (#98).
• labels-reconcile — grant callers private-repo check reads and warn when an entire PR sweep is blind (#95).
• labels-reconcile — the bootstrap now retires the six GitHub defaults LABELS.md publishes as deleted, tolerating both an already-absent label and a refused delete (#93).
• issueflow-reconcile — a triage-authored issue arrival stands down with exit 0 instead of killing the run before the sweep (#91).
• FLEET.md — the assignee's attention wake: one role-independent trigger ahead of every per-role list, one acked session per demand; a spec on paper until duty.sh polls it (#86).
• attention doctrine — define its assignee-owned pickup, ack, queue and clock semantics across labels, triage, and builder roles (#85).
• attention — add the issue-only, hand-set assignee-demand flag to the core label taxonomy (#84).
• One issue at a time counts build work in flight: the parked claim's three shapes, its declared-never-inferred comment, and triage's duty to name a directed hold as a park (#77).
• FLEET.md — the operator notifier's needs-ruling queue (one tracked message per item, edited in place across the rungs) and triage's past-24h wake condition; a spec on paper until an operator updates the box (#74).
• The sweep observes the escalation contract: a malformed escalation is named field-by-field, and the ladder's 12h/24h rungs each draw one comment to the flag-setter — comment-only, per-episode, both surfaces (#73).
• Ruling doctrine — define every human-owned trigger, the fixed escalation shape, and the 0–24h builder-to-triage ladder (#72).
• issueflow-reconcile — nudge once when an offsite flag outlives every visible cross-referenced PR (#69).
• offsite — protect claimed issues whose PR lives in another repository from the claim-reclaim clock (#68).
• issueflow-reconcile — keep cross-repo references out of local dependency decisions and require triage to resolve cross-repo blockers by hand (#61).
• actions/runner-isolated — a pull_request-triggered job may never run on a self-hosted runner (#58).
• Cross-repo doctrine: the panel is the PR's repo's roster, a review request is authorization but not panel membership, and Part of <repo>#N replaces the Closes #N that cannot cross repos (#57).
• The sweep's needs-ruling invariants, one implementation for both surfaces: the issue-side staleness exemption, the bare-flag check (comment-only, the label is never removed), and the 7-day nudge to the decider (#52).
• needs-ruling — the cross-cutting flag for a pending human decision, excluded from state:needs-human and from the staleness sweep (#51).

0.1.0 — 2026-07-22

• lib/version.sh — one version abstraction, file and package-json backends (#3).
• lib/changelog.sh + bin/changelog-section — the one canonical changelog-section extractor (#4).
• actions/changelog-armed — the version-keyed arming guard (#5).
• actions/changelog-monotonic — shipped release headings are append-only: no deletion, no duplication (#6).
• actions/drill-recorded — a release tree must carry its drill record (#7).
• lib/decide.sh — the merge door's five-state decision, pure and exhaustively tested (#8).
• .github/workflows/release.yml + lib/facts.sh — the reusable two-door release workflow (#9).
• .github/workflows/labels.yml + actions/labels-reconcile — label taxonomy bootstrap and PR-state reconciliation (#10).
• Ceremony adopts its own ceremony: VERSION, this changelog, the drill doctrine, the self-callers, and the self-guards in CI (#11).