Fix regex stalls, native owner reuse, and closeout release placement
Sync and closeout could place new deliveries under an old, untagged package version. Explicit native GitHub owners could acquire duplicate imports, and imported text exposed repeated regex scans.
Both reusable workflows forward --no-pending-release to the standard changelog script. Leading native ownership declarations reuse the owner without replacing local delivery evidence. Disjoint regex branches and backward scans retain accepted inputs with linear work. The watchdog publishes readiness synchronously before its CPU spin.
The branch includes main 4ff22de (PR #159), retaining delivery-PR selection, release placement and linear-time scanning. Only the changelog conflicted; both entries survive. The remaining three single-sample timing guards now take the fastest of three samples at the unchanged 50 ms limit, matching the phone and key guards.
| Unresolved thread | Verified fix |
|---|---|
PRRT_kwDOTbN4pM6uilD- | Sample ownership, locator and API-base guards three times; assert the result on every trial and retain the 50 ms limits. |
All five review threads and every comment were read with complete pagination. One thread remains unresolved as requested; no thread was replied to or resolved. The latest CodeRabbit review has no Outside diff range findings. Whole-diff self-review found no further instance; no finding was rejected.
Revert proofs: the deterministic clock replay accepts [100,1,2] ms and rejects [100,100,100] ms across all three guards. Independently restoring only each original guard makes the scheduler-pause regression fail 0/1, with its corresponding 100.000 ms versus 50 ms assertion (inner results: 2 pass, 1 fail). Every mutation was restored. Previous placement, owner-reuse, regex and watchdog revert proofs remain in append-only PM history.
Validation of code commit 267d9885f10fce20f565d1b834602bf4c16a5da9, with unchanged thresholds:
- CI 39508368529 passes on Node 22 and Node 26. Each job passes every release-check component, 979/979 coverage tests and 979/979 native Bun tests over 46 files, with zero failures, cancellations or skips. All 16 authored modules satisfy exact 100/100/100/100 coverage. CodeQL also passes.
node_modules/.bin/pm test pm-github-lfcf --run --timeout 2400 --progresspasses 6/6 commands and 120/120 tests, including both PRs' regressions and the full 102-test closeout/attribution suite.- Clean-HOME/Git-isolated
npm run release:checkandbun run release:checkwere attempted sequentially and stopped at their host-load budgets (1,825 and 1,810 seconds, exit 143). They are not local gate passes. Their shutdown summaries contain zero failed assertions and 22/9 cancelled tests respectively. Acceptance uses the successful exact-head CI under the task's host-load exception. - The local Bun entry point passes all pre-coverage checks, including privacy over 6,104 Git objects. Its remaining audit (zero vulnerabilities), package dry-run (29 files), changelog check and publish-attestation check pass separately.
- All 151 tracked source/test/configuration/documentation fingerprints remain unchanged. Final receipt changes are limited to PM metadata and history. Regenerated changelog and tracker validation pass; existing metadata, resolution, file-link and command-reference advisories remain. Strict item history verification passes all 74 entries and matches the current item. The final staged privacy gate audits 6,106 objects with approved identities and no secret or host-path matches.
Generated dist/ is ignored and has been rebuilt. Existing local extension-host version skew and previously tracked parser/wording follow-ups remain separate from release acceptance.
Receipt: final PM record.
PM: pm-github-lfcf. The item remains in progress and is released for orchestrator verification. PR #159's tracker record is retained from main. Detailed replay evidence: docs/changelog-release-placement.md.
Delivers pm-github-lfcf
Delivers pm-github-sah1