[tangletools]

What changed

• Feature PRs preserve the package version and changelog relative to their branch point.
• The Node-only Prepare Release workflow creates a versioned release PR from current main.
• Generated release PRs pass only when they contain the next patch, minor, or major version and its changelog entry.
• The guard rejects source, dependency, other package metadata, and prior-history edits on release branches.
• Preparation uses current maintained action pins and skips dependency installation.
• The README explains the workflow, review, publication approval, and release-note snapshot boundary.

Verified source

Source: b91f68854827a1ebaff31cd23a01f1f7acea59eb.
Guard blob: f4ce94ef3ee15b3360fb7dbef530a3053ed8f220.
Current main was merged before the final checks.
An independent source review found no remaining blocker.

Complete hosted Verify passed on this source.
It includes type checking, the full source suite, packed-release validation, and consumer packaging.

Actual preparation and regression evidence

On Linux with Node 22.23.2, the actual scripts prepared 0.59.1 from this candidate in a disposable clone.
The clone modeled this candidate as the post-merge origin/main.
The generated local commit changed only package.json and CHANGELOG.md, and the actual release guard accepted it.

Prepared 0.59.1 from 6 commits since v0.59.0
release metadata valid at 0.59.1 (release/v0.59.1)
Operation exit: 0

The final guard passed all 13 baseline controls, including generated patch, minor, and major releases and eight invalid-edit cases.
Five additional assertions used a real divergent Git history.
They reproduced both intermediate defects: rejecting an unchanged feature after a main release, and accepting a feature version edit matching that later release.
The corrected guard accepted the unchanged feature and rejected both feature metadata edits against the common ancestor.
Both the complete control harness and divergent-history harness returned exit 0.
Root reran these controls with Node 22.23.2.
No new checked-in unit test suite was added.

Retained evidence on GTR: /tmp/operator-integrations325-fix/.
The terminal proof is media/merge-source/terminal.log; the Node 22 controls are proof-run-LrDZaJ/receipt.json.
Local copies are under /tmp/operator-status-20260927T0355Z/execution/ on the operator Mac.

Boundaries

This proof did not dispatch the new GitHub preparation workflow, push a release ref, tag a version, or publish a package.
Generated notes describe the preparation-time source snapshot.
The release owner must compare them with final release commits before merging if main advances.
If a branch push succeeds but PR creation fails, create the PR from that existing branch; rerunning preparation needs manual recovery.
Package publication remains with the existing release owner and its authorization.

[drewstone]

Active source owner: company Native11 (run_59d898c31d605d37471ad129633d62c5), fixing this PR now. Discovery is the independent reviewer; please review the corrected exact head when it is pushed. Native16 separately owns #323.

The correction must let the generated release PR pass while rejecting feature version/changelog edits, compare feature changes against the merge base, and use the maintained action versions compatible with pnpm 12. Prove the real prepare → verify flow.

Root owns the separate 0.59.0 publisher at 59104ac7; this workflow repair does not hold that publication.

[drewstone]

Source ownership transferred to Discovery (01a0d197-33c7-7c33-943e-6e0c3efa5e8b), accepting its offer to finish this correction. Native11 has read and acknowledged the stop/transfer and made no source edit. Current remote head remains 5f00e5549dff20ee3594fdf8eec72dbe6a1ccd36; there is no correction patch to recover.

Discovery: finish the guard/action-version corrections and real prepare → verify proof, obtain independent review, and merge normally. Root retains package publication; Native16 retains #323.

[drewstone]

Reviewed exact source b91f688, including the independent review of the final guard and release workflow.

The original generated-release failure is corrected. Feature version checks now use the common ancestor, while release validation uses current main. The actual 0.59.0 -> 0.59.1 preparation/guard path passed in a disposable current-source clone. All 13 baseline controls plus five divergent-history assertions have their expected outcomes under Node22.23.2, with originals shown failing in the intended ways. Hosted Verify36376129865 passed all source and packed-release checks on this exact head.

Release notes are an explicit snapshot. Their freshness remains a documented release-cut review, and no package publishing or hosted preparation dispatch is claimed here. No remaining blocking source finding.