TWO STALE PREMISES IN THE SAME SECTION, BOTH NOW MEASURED
1. The pin. Session G's gate was written against okf pinning the guard
`>=0.2,<0.3` with `[tool.uv.sources]` tag `v0.2.0` — true when written
(their HEAD 4ea00a9), and the whole reason the gate says a green answer
proves nothing: `<0.3` excluded the versions the fixtures were meant to
exercise, so uv resolved v0.2.0 and came back green for free.
Read from their pyproject.toml today, not from their coord message: they are
on `>=0.3,<0.4` with tag `v0.3.4`. That inverts the consequence — an
unchanged tree now resolves v0.3.4, which is inside what the gate asks for,
so the null result is gone.
Two things follow and neither is settled here. `<0.4` excludes 0.4.0 and
0.5.0, so the axis separation and the input-cap refusal are outside anything
okf can measure today. And the gate says "passes against guard 0.3.1" while a
run today measures 0.3.4 — whether that counts as satisfied is an operator
decision, deliberately not taken. The transitive-arrival bullet is corrected
the same way: an accidental consumer lands on v0.3.4 now, not v0.2.0.
2. The file list. It named four release surfaces. The 0.5.0 sweep found five
more carrying a version claim that no release had ever touched — and one of
those five was `**Status:** v0.3`, which this very line already named, and
0.4.0 missed anyway. Writing down a trap is not applying it.
Replaced with the nine current-state surfaces, plus the rule that made the
sweep safe: sort every hit into current-state or measurement provenance
BEFORE editing, because a version sweep also hits "verified identical on
0.2.0 and 0.3.1" and bumping that falsifies the record. So it can never be a
sed pass.
The key-assumption test went with it. "grep all four files" presupposed the
list it was supposed to verify. It is now a git grep over all tracked files
with each hit classified, plus `git show <pre-tag-sha>:README.md` — the check
that proves what the tag will carry, run while the tag does not yet exist.
That ordering is the fix; v0.4.0 verified afterwards and carries a stale
README permanently as a result. SECURITY.md gets a note that at 1.0.0 its
sentence is rewritten, not bumped: "pre-1.0" stops being true.
Kjell Tore Guttormsen
0dce50fb05