[scottconverse]

Records previously accepted completed exports from response A after response B was approved. Fulfillment now requires response and release-package exports matching the current approved response hash. Receipts list matching exports; historical artifacts remain intact.

The required frontend dependency audit also exposed GHSA-g3hv-75wg-m249 in unchanged build tooling. Pin Redocly's minimatch to 11.0.4 and adapt its former CommonJS function import with a checked, idempotent postinstall script. Keep openapi-typescript 7.13.0 and Redocly 1.34.21; the script fails if the expected Redocly version/import changes and exercises matching and nonmatching HTTP-header rules without network access. Generated API types remain unchanged. Audit enforcement is preserved.

Validation:

• Reproduced stale-export fulfillment before fixing; 13 affected authenticated API/PostgreSQL/export-file tests passed.
• Previous PR candidate passed full backend CI, bootstrap, Ruff and recovery checks; its frontend audit failure prompted the dependency correction.
• Final dependency candidate: clean npm ci, audit (zero vulnerabilities), unchanged generated types, 42 unit tests, both browser skip-link checks, and build passed locally.
• Recovery, tracked-file secret scan, project-environment provenance and diff checks passed. Required CI runs on the final head.

Source correction only; installer release and organization-site publication remain separate. The governance record is merged in townlight/townlight#293.