rabii-chaarani · Oct 27, 2026 · Oct 27, 2026 · Oct 27, 2026 · Oct 27, 2026 · Oct 27, 2026
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -375,7 +375,7 @@ jobs:
           mkdir -p dist/release-assets
           while IFS= read -r -d '' artifact; do cp "$artifact" dist/release-assets/; done < <(find dist/native -type f -name 'codebase-graph-*.tar.gz' -print0)
           while IFS= read -r -d '' checksum; do cp "$checksum" dist/release-assets/; done < <(find dist/native -type f -name 'codebase-graph-*.tar.gz.sha256' -print0)
-          test "$(find dist/release-assets -type f | wc -l | tr -d ' ')" = '8'
+          test "$(find dist/release-assets -type f | wc -l | tr -d ' ')" = '4'
       - name: Upload validated release set
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:

diff --git a/.release-please-manifest.json b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "4.0.0"
+  ".": "4.0.1"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,22 @@
 # Changelog
 
+## [4.0.1](https://github.com/rabii-chaarani/codebaseGraph/compare/v3.0.4...v4.0.1) (2026-10-27)
+
+This release replaces the unpublished 4.0.0 proposal ([#156](https://github.com/rabii-chaarani/codebaseGraph/pull/156)). Its production gate failed before any tag or release was created. The storage changes below are included because 3.0.4 remains the last published release.
+
+### ⚠ BREAKING CHANGES
+
+* **storage:** database open helpers return GuardedDatabase and reject path forms whose native resource identity cannot be proven. Connections borrow the guarded handle; canonical Windows extended paths retain their namespace.
+
+### Features
+
+* **storage:** automate graph disk cleanup and controlled legacy retirement ([#153](https://github.com/rabii-chaarani/codebaseGraph/pull/153)) ([75a99c8](https://github.com/rabii-chaarani/codebaseGraph/commit/75a99c840aa53e75a3f14df8dab41979c9efa19c))
+
+### Bug Fixes
+
+* **ci:** archive historical Python evidence helpers without changing their bytes, and check repository release policy in ordinary CI ([#159](https://github.com/rabii-chaarani/codebaseGraph/pull/159)) ([34eac4f](https://github.com/rabii-chaarani/codebaseGraph/commit/34eac4f8644adc046093babd84ee1fdbffdae853))
+* **release:** stop replaying old release overrides when a manifest version has no published tag, and stage the four public archive/checksum files for the two supported native targets ([#162](https://github.com/rabii-chaarani/codebaseGraph/pull/162)).
+
 ## [4.0.0](https://github.com/rabii-chaarani/codebaseGraph/compare/v3.0.4...v4.0.0) (2026-10-27)
 
 

diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "codebase-graph"
-version = "4.0.0"
+version = "4.0.1"
 edition = "2021"
 rust-version = "1.82"
 description = "Native codebaseGraph CLI and MCP server for local code knowledge graphs."

diff --git a/crates/k-wiki/Cargo.toml b/crates/k-wiki/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "k-wiki"
-version = "4.0.0"
+version = "4.0.1"
 edition = "2021"
 rust-version = "1.82"
 description = "OKF knowledge wiki, projection builder, and MCP service."
@@ -24,7 +24,7 @@ bundled-windows-extensions = ["codebase-graph/bundled-windows-extensions"]
 # The patched 4.1 backport preserves the workspace's Rust 1.82 MSRV.
 ammonia = "~4.1.8"
 axum = { version = "0.8", default-features = false, features = ["http1", "json", "tokio"] }
-codebase-graph = { version = "4.0.0", path = "../.." }
+codebase-graph = { version = "4.0.1", path = "../.." }
 pulldown-cmark = { version = "0.13", default-features = false, features = ["html"] }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"

diff --git a/crates/xtask/Cargo.toml b/crates/xtask/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "xtask"
-version = "4.0.0"
+version = "4.0.1"
 edition = "2021"
 publish = false
 

diff --git a/crates/xtask/src/release/workflow_tests.rs b/crates/xtask/src/release/workflow_tests.rs
@@ -255,6 +255,40 @@ fn proposal_reports_pending_release_then_proceeds_after_finalization() {
     assert!(!f.output().contains("ready=true"));
 }
 
+#[test]
+fn staged_assets_match_the_supported_native_targets() {
+    let script = step("validate-artifacts", "Stage complete validated set");
+    for complete in [true, false] {
+        let f = Fixture::new();
+        let native = f.root.join("dist/native");
+        fs::create_dir_all(&native).unwrap();
+        for target in crate::NATIVE_TARGETS {
+            let archive = target.archive_name("2.0.0");
+            fs::write(native.join(&archive), b"validated archive").unwrap();
+            fs::write(native.join(format!("{archive}.sha256")), b"checksum").unwrap();
+        }
+        if !complete {
+            let archive = crate::NATIVE_TARGETS[0].archive_name("2.0.0");
+            fs::remove_file(native.join(format!("{archive}.sha256"))).unwrap();
+        }
+        let output = f.execute(&format!("set -euo pipefail\n{script}"), &[]);
+        assert_eq!(
+            output.status.success(),
+            complete,
+            "{}",
+            String::from_utf8_lossy(&output.stderr)
+        );
+        if complete {
+            assert_eq!(
+                fs::read_dir(f.root.join("dist/release-assets"))
+                    .unwrap()
+                    .count(),
+                crate::NATIVE_TARGETS.len() * 2
+            );
+        }
+    }
+}
+
 #[test]
 fn ci_run_recovery_dry_run_validates_without_authorizing_publication() {
     let f = Fixture::new();

diff --git a/docs/release.md b/docs/release.md
@@ -161,6 +161,23 @@ After upgrading from a release archive:
 
 To force a specific next version, merge a commit whose body contains a `Release-As: X.Y.Z` trailer.
 
+### Unpublished 4.0.0 recovery
+
+Release PR #156 merged as 4.0.0, but its immutable source failed the production repository gate before publication.
+PR #159 corrected that gate on later main; it cannot change the old release source. PR #162 therefore proposes 4.0.1
+from corrected main instead of retrying or tagging the failed 4.0.0 source. The old proposal remains unpublished, not tagged.
+
+`release-please-config.json` uses that failed merge, `7038e66ff8271ffddc511f879cf8d28353a09b2d`, as its
+`bootstrap-sha` commit cutoff. When the manifest's tag is missing, this prevents a full-history scan from replaying
+an old `Release-As: 1.2.2` trailer. The cutoff is not evidence of publication and does not authorize a tag, CI run,
+or artifact source. Once the manifest version has a real release tag, release-please ignores the bootstrap cutoff.
+No permanent `release-as` version pin is used. The 4.0.1 notes explicitly include the unpublished storage change;
+all existing exact-SHA CI, production, artifact, and crate-publication gates still apply to the new release merge.
+
+Until this correction reaches main, another ordinary main merge can make the old generator overwrite the open PR.
+Reapply the reviewed correction if that happens; do not publish a placeholder 4.0.0 tag or clear pending labels to
+work around proposal generation. Publication and maintainer merge approval remain separate from this repair.
+
 ## Conda-Forge Release Path
 
 This repository intentionally does not upload directly to Anaconda.org. Conda distribution should go through

diff --git a/docs/testing/release-pr-162/README.md b/docs/testing/release-pr-162/README.md
@@ -0,0 +1,43 @@
+# Release PR #162 repair evidence
+
+Work: **COD-100 / GH-162** · Scryer change: `chg-9sernm`.
+
+The user approved “make it 4.0.1 and resolve the issues first” on 2026-10-27. This is a proportional repair under the existing [release process](../../../docs/release.md) and the canonical wiki `knowledge/architecture/release-verification.md`; no new architecture or publication contract is introduced. Merge, exact-source main CI, publication and maintainer-owned closure remain separate.
+
+## Acceptance evidence
+
+| Criterion | Evidence |
+| --- | --- |
+| Stop replaying the old `Release-As: 1.2.2` and unrelated historical notes | `generator-audit.md`, `generator-4.0.1.json`: actual release-please 17.6.0, writes blocked, manifest 4.0.0 plus failed-release bootstrap cutoff yields 4.0.1. `generator-future.json` distinguishes a local overlay from synthetic future tagged states. |
+| Keep all package/dependency/lock/manifest versions consistent at 4.0.1 | `verification.json` snapshot hashes; locked Cargo metadata; `verify-release-version v4.0.1`; immutable metadata helper after commit. |
+| Preserve unreleased storage changes and report 4.0.0 truthfully | `CHANGELOG.md` 4.0.1 includes the storage feature and breaking change; comparison starts from published v3.0.4. Historical 4.0.0 section stays. Failed PR156 is not tagged or described as published. |
+| Stage the complete supported artifact set without accepting an incomplete set | New `staged_assets_match_the_supported_native_targets` executes actual workflow Bash with two target archives and checksums. `asset-staging-baseline.log` demonstrates failure before 8→4 fix; `xtask.junit.xml` records 44 passing tests, including incomplete-set rejection. |
+| Preserve release gates | `local-checks.log`: format, warnings-denied xtask Clippy, workflow policy, normal and production repository gates, and v4.0.1 version validation pass. Confirmation arguments reproduce existing job settings, not new environment approval. |
+
+## Reproduction
+
+From this checkout, with an isolated `CARGO_TARGET_DIR` if sharing other worktrees:
+
+```text
+cargo fmt --check
+cargo nextest run -p xtask --locked --config-file docs/testing/release-pr-162/nextest.toml --profile cod100
+cargo clippy -p xtask --all-targets --locked -- -D warnings
+cargo run -p xtask --locked -- check-workflows
+cargo run -p xtask --locked -- release-gate
+cargo run -p xtask --locked -- release-gate --production --confirm release-environment --confirm private-vulnerability-reporting
+cargo run -p xtask --locked -- verify-release-version v4.0.1
+cargo metadata --no-deps --locked --format-version 1
+cargo run -p xtask --locked -- release-metadata --source-sha <this-checkout-HEAD> --source-dir .
+```
+
+The generator check is a separate isolated Node project, not a repository dependency. Install `release-please@17.6.0`
+there and copy `read-only-generation.cjs` into that directory. Supply a GitHub read token on stdin through the normal
+CLI credential flow; never save it to a file or log it. The script guards REST writes and GraphQL mutations, only
+builds candidates/change sets, and writes the two scenario reports in its current directory. It tests current main,
+so its output changes after this PR merges. The committed JSON records the exact live-main baseline named above.
+
+The recorded environment is local Darwin ARM64, Cargo 1.96.0, nextest 0.9.140. These checks do not qualify native Windows/macOS consumer archives or substitute for PR/main CI. No tag, release, crate, workflow dispatch, merge or release-label mutation is part of this repair.
+
+The original working tree has unrelated edits and an older checkout. Scryer is configured against it, so these isolated-snapshot passing reports must not be fingerprinted as evidence for those different source files. Source/test hashes and JUnit are retained here for correct-snapshot reconciliation. No whole-project drift advancement was performed.
+
+Until this configuration reaches main, a new ordinary main CI completion can regenerate the old proposal over the open PR. There is no supported open-PR hold label in release-please 17.6.0. Do not bypass recognition by removing pending labels, fabricate a v4.0.0 tag, or change workflow permissions to mask that risk.
diff --git a/docs/testing/release-pr-162/asset-staging-baseline.log b/docs/testing/release-pr-162/asset-staging-baseline.log
@@ -0,0 +1,59 @@
+   Compiling libc v0.2.189
+   Compiling version_check v0.9.5
+   Compiling proc-macro2 v1.0.106
+   Compiling unicode-ident v1.0.24
+   Compiling quote v1.0.45
+   Compiling serde_core v1.0.228
+   Compiling typenum v1.20.1
+   Compiling cfg-if v1.0.4
+   Compiling rustix v1.1.4
+   Compiling serde v1.0.228
+   Compiling crc32fast v1.5.0
+   Compiling zmij v1.0.21
+   Compiling generic-array v0.14.7
+   Compiling bitflags v2.13.0
+   Compiling adler2 v2.0.1
+   Compiling simd-adler32 v0.3.10
+   Compiling itoa v1.0.18
+   Compiling hashbrown v0.15.5
+   Compiling equivalent v1.0.2
+   Compiling serde_json v1.0.150
+   Compiling indexmap v2.7.1
+   Compiling miniz_oxide v0.9.1
+   Compiling ryu v1.0.23
+   Compiling libyaml-rs v0.3.0
+   Compiling memchr v2.8.2
+   Compiling syn v2.0.117
+   Compiling serde_derive v1.0.228
+   Compiling errno v0.3.14
+   Compiling cpufeatures v0.2.17
+   Compiling filetime v0.2.29
+   Compiling xattr v1.6.1
+   Compiling tar v0.4.46
+   Compiling crypto-common v0.1.7
+   Compiling block-buffer v0.10.4
+   Compiling digest v0.10.7
+   Compiling sha2 v0.10.9
+   Compiling flate2 v1.1.10
+   Compiling yaml_serde v0.10.7
+   Compiling xtask v1.2.2 (/private/tmp/codebasegraph-cod100-release-401/crates/xtask)
+    Finished `test` profile [unoptimized + debuginfo] target(s) in 6.29s
+     Running unittests src/main.rs (/private/tmp/codebasegraph-cod100-cargo-target/debug/deps/xtask-d46547d2161cf356)
+
+running 1 test
+test release::workflow_tests::staged_assets_match_the_supported_native_targets ...
+thread 'release::workflow_tests::staged_assets_match_the_supported_native_targets' (35033717) panicked at crates/xtask/src/release/workflow_tests.rs:276:9:
+assertion `left == right` failed:
+  left: false
+ right: true
+note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
+FAILED
+
+failures:
+
+failures:
+    release::workflow_tests::staged_assets_match_the_supported_native_targets
+
+test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 43 filtered out; finished in 0.03s
+
+error: test failed, to rerun pass `-p xtask --bin xtask`
diff --git a/docs/testing/release-pr-162/delivery.md b/docs/testing/release-pr-162/delivery.md
@@ -0,0 +1,23 @@
+# Release repair delivery
+
+- Work: COD-100 / GH-162; Scryer `chg-9sernm`, proportional repair with no changed architecture claims.
+- User approval: “make it 4.0.1 and resolve the issues first”, 2026-10-27. This authorizes the open-PR repair, not a merge or publication.
+- Source repair commit: `654e1c6aabf7126b1732992bd17f86bb9ef37ff3`. Whitespace-only evidence follow-up: `39e817427bd9cd8fb65f6ff907599e0b7ff6ec6f`. Both retain the ten reviewed source/test hashes in `verification.json`.
+- Existing PR: https://github.com/rabii-chaarani/codebaseGraph/pull/162; title now `chore(main): release 4.0.1`; body contains the curated 4.0.1 notes. Trusted pending label preserved.
+- Failed unpublished 4.0.0 proposal: https://github.com/rabii-chaarani/codebaseGraph/pull/156#issuecomment-6437846462. Supersession is truthful commentary only; no tagged label or placeholder tag.
+- Local checks: 44/44 nextest release-tool tests (JUnit), warnings-denied scoped Clippy, formatting, workflow policy, normal/production release gates, version validation and locked metadata passed. Actual pinned generator read-only checks demonstrate version-boundary recovery and future normal operation.
+- Committed-source metadata helper run at `654e1c6aabf7126b1732992bd17f86bb9ef37ff3` returns that exact source SHA, version 4.0.1, tag v4.0.1, and the exact curated nonempty notes. This validates metadata, not main-history membership, CI or publication authority.
+- Fresh independent review: GPT-6.1 Sol / Max (`openai-codex/gpt-6.1-sol`, `thinking=max`), exact ten-file hash snapshot, no confirmed P0–P3 findings. Independent 44-test rerun passed. See `final-review.md`.
+- Observed hosted CI for `39e817427bd9cd8fb65f6ff907599e0b7ff6ec6f`: https://github.com/rabii-chaarani/codebaseGraph/actions/runs/40478036814, queued at delivery. Later documentation/memory-only delivery commits have identical reviewed source hashes and require their own current PR check status. Do not interpret queued or configured jobs as passing evidence.
+- Linear: https://linear.app/codebasegraph/issue/COD-100/correct-release-pr-162-to-401-and-reconcile-failed-400-proposal, In Review pending hosted gates and maintainer acceptance.
+- Reusable knowledge: `memory/procedural/missing-manifest-release-replays-version-overrides-2026-10-27`, recorded/verified/activated through configured k-wiki. Recommended validation accepted with zero diagnostics; link check zero diagnostics; configured site build succeeded (328 routes, 2 assets). Existing architecture/wiki spec identities and approvals retained.
+
+## Unchanged limitations
+
+No merge, tag, release, registry publication, workflow dispatch, release-label mutation or integration-settings change was performed. The old source remains unpublished. Eventual release requires its own successful exact-source main-push CI and unchanged production/artifact/crate gates.
+
+Until the corrected config reaches main, another ordinary main CI completion can overwrite the manually repaired open PR. Recheck/reapply the reviewed correction if that occurs; no supported hold label exists.
+
+Scryer/graph are configured against the unrelated original checkout. JUnit and exact source hashes are retained; do not ingest them as passing fingerprints of different original-worktree source or advance whole-project drift. No new or changed claims were needed. The graph does not index hidden release config/workflow or the split release test file; Scryer file anchors and discovered xtask/docs scoped inspection.
+
+Original unrelated source/wiki/spec edits were preserved. The new focused memory and generated wiki output are the only intentional additions in that original knowledge bundle; generated `.kwiki` state was built through k-wiki, never edited manually.