[LE0-Lin]

Summary

• Distinguish absent local history from corrupt/unreadable history. Invalid stores now raise HistoryError (ValueError), and CLI history returns operational exit 2 with empty stdout instead of a clean empty report.
• Validate the full list before visibility/retention: reject malformed UTF-8/JSON, non-object rows, duplicate decoded names, non-finite JSON numbers and nonnumeric/Boolean/out-of-range scores. Keep partial legacy records, missing/null scores and unknown metadata without relabelling historic tool identity.
• Refuse known symlink/reparse/nonregular history-store paths before content reads or append setup. Explicit repository-root aliases remain allowed; this is not a hostile-filesystem sandbox.
• Serialize before creating a temporary file; write/flush/fsync a complete file beside the index, then replace it instead of truncating existing history. Tested ordinary write/sync/replacement failures preserve previous bytes; cleanup is best-effort. No writer locking, concurrent update transaction or power-loss durability claim.
• Add 22 regression contracts, an installed-wheel history journey across aliases/module/direct helper, recovery/API compatibility guidance and synchronized English/Simplified/Traditional core docs.
• Source only: no release/version/tag/v0 update, scoring/default change, automatic history reset/import, frozen-research rewrite or external maintainer contact. Normal scans still do not append local history; immutable CI artifacts are separate.

Verification

• Reproduced old silent-empty/overwrite behavior with new contracts before implementation; regression log retained locally.
• Full Windows suite: 516 tests, 505 passed and 11 platform skips.
• Linux history-preservation suite: all 22 passed, including FIFO/link controls.
• Wheel/source-distribution builds and all 15 installed-wheel acceptance journeys passed offline. Valid partial legacy history and full-trend/limited-display behavior remain covered.
• Demo remains F 56. These synthetic engineering checks are not independent accuracy, real-user adoption or evidence-authenticity measurements.
• Runtime source identity: 4766d5a3a91bcf78c5a114da25187b74188b3c1c72b83543d0ae4741c5eaf261.
• Exact-head cross-platform CI and pinned-repository smoke replay run before merge; expected operational rejection remains distinct from a clean scan.