docs(6.0): backfill the changelog for the release's back half, and say what the release lane has actually run

[0xLeif]

CHANGELOG.md

The [Unreleased] section covered 6.0 work through PR #627 and then stopped. Every PR from #630 through #727 had no entry — 46 merges, ~52 issues, the entire back half of the release, including every defect an adopter reported against a release candidate.

46 entries are added: 3 Added, 8 Changed, 3 Security, 32 Fixed. The existing Removed entry (the Windows binary) stays first — it is the single most important thing an upgrader needs, and burying it under 1,700 lines of newer prose would be a regression in the document's job.

Nothing existing was touched: verified mechanically that every line of the previous file survives (1,662 lines, all accounted for).

Entries were derived from diffs and issue threads, never from commit subjects

That is not ceremony. Three issues this release — #699, #706, #719 — were filed with diagnoses that were directionally right and specifically wrong, each caught only when an implementer re-derived from source. Writing 46 entries from commit titles would have laundered every one of those errors into the release's public record.

It found seven divergences, kept as HTML comments beside the entries they explain — invisible when rendered, available to anyone doing archaeology later. Two are worth naming here:

• fix(release): the lane must be able to read the tag that triggered it #668 — "the lane must be able to read the tag that triggered it". Its entire diff is fetch-tags: true on actions/checkout, which is a no-op on that code path: the action assigns fetchTags only inside its fetchDepth > 0 branch, so at fetch-depth: 0 it is silently dropped. fix(release): a release candidate must be installable without release-grade provenance #669 established this 39 minutes later, removed the line, and replaced it with an explicit git fetch --force. The entry credits fix(release): a release candidate must be installable without release-grade provenance #669.
• fix(parser): one canonical frontmatter reader, because a Windows clone could not view a single spec #715 — "one canonical frontmatter reader". The diff unifies four strippers and makes parse_frontmatter CRLF-tolerant, but two non-canonical readers survive on main: registry.rs's line-wise extract_module_name and commands/lifecycle.rs's unanchored find("---\n"). The commit body is honest about this; the subject is not.

docs/ci-confidence.md

Its "Tag authority" section reasons carefully about what the release lane enforces and never says which of it has ever run. A new subsection records that:

Job	Status
resolve	Executed — the workflow_dispatch dry run, first in the repository's history
validate	Executed, same run
qualify	Executed for the first time on rc.8, failing on Windows
promote	Never executed

promote cannot be rehearsed here: final_tag derives from the candidate's own Cargo.toml, so any run against a real candidate mints the real tag. The proof and the release are the same event.

What was proven ahead of time is recorded with its limits. The Create final tag step was transcribed verbatim against a local bare repository and all three branches exercised — a fresh create produces an annotated tag pointing at candidate_sha and not HEAD; a re-run against the same candidate takes the idempotent path; a re-run against a different candidate refuses. And both rulesets were confirmed to carry update and deletion only, so tag creation is unrestricted and immutability cannot block the mint — the failure that would otherwise have appeared for the first time at the moment of release.

What remains unproven is named rather than glossed: a local path remote never asks for a credential, so the rehearsal shows the credential helper's git -c syntax does not break the invocation, not that it authenticates.

Deliberately not done

Consolidating the pre-existing duplicate ### Fixed and ### Changed headings inside [Unreleased]. They were already there; fixing them means reordering ~700 lines of prose nobody is changing and would bury 46 new entries in an unreviewable diff. Recorded in the change's context.md.

Findings that became their own issues

The backfill surfaced three defects too substantial to fix inside a docs change: #728 (a live requirement describing behaviour deleted by #665, invisible to check by construction), #729 (ADOPTING.md leads with the pre-#689 squash cost), and #730 (the delta binding hashes raw bytes while the applier normalizes line endings).

change check exit 0 · 2395 unit + 407 integration · independent review recorded · finalized · change audit --strict exit 0.

🤖 Generated with Claude Code

https://claude.ai/code/session_01DgYAvsQM6P9fKxDotnDuzP

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.