fix(release-lib): close six doctrine-deletion blind spots in governance rules

[SUaDtL]

Summary

_GOVERNANCE_RULES in .github/scripts/test_release_lib.py pins load-bearing sentences in the release skill by asserting a set of anchor tokens is present. A rule fires only when all its tokens are present, so it could detect its own deletion only if at least one token disappeared entirely when the protected sentence went. Six rules had every anchor token also occurring elsewhere in the file, so the guarded sentence could be deleted while the rule stayed green.

Each is now re-anchored on a span unique to its own guarded sentence. _KNOWN_WEAK_ANCHORS — the ratchet that declared the six as known-weak — is now the empty set.

Counts below are re-measured against current main (32b0992), not the issue's original numbers — the file has moved since #571 was filed (notably #617's run-15 ${VERSION} rename, which the issue's own git rev-parse ... MAJOR.MINOR.PATCH quote predates).

rule	old anchor (occurrences, re-measured)	new anchor added	deletion scenario proven
footer BLOCK / never-auto-fill	CHANGELOG: x10, auto-fill x2	MUST NOT auto-fill a missing	Hard Rules bullet deleted; Phase-1 step-3 prose alone left both old tokens intact
publish read-back	gh release view x3, non-draft x4	MUST verify the published Release by read-back	Hard Rules bullet deleted; the isDraft probe + Phase-3 read-back sentences alone left both old tokens intact
immutable-tag hard rule	published tag is immutable x2	Correction means publishing a NEW version	"Recovering from a bad release" opening sentence deleted; the Phase-2 cleanup-mode mention alone left the old token intact
pre-tag BLOCK-on-nonzero	pre-tag x25, non-zero exit x5, BLOCK x15	BLOCK on a non-zero exit	Hard Rules bullet deleted; the word's other 24/4/14 occurrences elsewhere left all three old tokens intact
HIGH-1 (re-run): tag_sha peeled, never a raw rev-parse	git rev-parse ${TAG_PREFIX}${VERSION} x2, peel-tag x3	never from a bare `git rev-parse	The "never a raw rev-parse" warning sentence deleted; Phase-3 step-5's provenance command and the adjacent peel-tag sentences left both old tokens intact
HIGH-2 (re-run): back-fill declares latest-eligible for its one target	latest-eligible: true` x5, single-target x3	this lane can only ever propose ONE row	The back-fill detect-step sentence deleted; four other latest-eligible: true mentions and two other single-target mentions left both old tokens intact

Proof

Pinned as a permanent RED/GREEN mutation proof (DoctrineDeletionMutationProofTest, new class in .github/scripts/test_release_lib.py), run against the real core/surface/skills/release/SKILL.md source text, never a synthetic fixture:

• Each rule's whole guarded sentence — located by a (start marker, end marker) pair, not the new anchor span in isolation (an isolated-span proof would be tautological: any unique string added as a token catches its own deletion, and the ratchet test already proves uniqueness) — is deleted from a copy of the source text.
• RED: the OLD (pre-Six governance rules cannot detect deletion of the doctrine they guard #571) token tuple, pinned in the test as a fixed historical baseline never read from the live dict, stays silent against the mutilated text — reproducing the exact defect.
• GREEN: the CURRENT _GOVERNANCE_RULES entry for that same rule reports it missing — proving the fix, and that the new anchor token actually falls inside the sentence it's meant to guard (asserted directly in the test).

Exact counts:

• python -m pytest .github/scripts/test_release_lib.py -q -> 360 passed, 292 subtests passed (357 pre-existing + 3 new: test_the_six_rules_are_exactly_the_ones_pinned_here, test_deleting_the_whole_guarded_sentence_is_red_under_the_old_anchor, test_deleting_the_whole_guarded_sentence_is_caught_by_the_current_anchor).
• GovernanceSurvivalTest.test_every_rule_has_at_least_one_uniquely_occurring_anchor now passes with _KNOWN_WEAK_ANCHORS == set().
• unittest discover -s plugins/ca/hooks/tests (via pytest) -> 1347 passed, 153 subtests passed - untouched by this change, run as a regression check.
• tools/sync-core.py --check and tools/build-surface.py --check -> both OK (no core/ content changed by this PR - only the CI-side test file and version-advance surfaces).

Also verified (issue's "verification habit" note)

The issue flags grep -c (counts matching lines, not occurrences) as an unreliable way to check anchor uniqueness on this file's thousand-character single-line steps. Confirmed no .github/scripts/*.py file uses grep -c for this purpose - the only grep -c string in the tree is the historical comment describing the defect, inside test_release_lib.py's own docstring. All new counting in this PR uses str.count.

Version advance (merge-train slot)

ca 2.11.11 -> 2.11.13, ca-codex 0.4.10 -> 0.4.12, ca-pi 0.2.11 -> 0.2.13 - root package.json regenerated via tools/build-host-packages.py, root CHANGELOG.md and plugins/ca-pi/CHANGELOG.md both carry dated 2026-08-05 sections, README badge and ships-line updated. This PR's diff carries no plugins/ca/**, plugins/ca-codex/**, or plugins/ca-pi/** payload change (CI scripts only), so payload_version_gate.py --plugin plugins/ca --base origin/main and --plugin plugins/ca-codex both report no shipped payload change - version bump not required (pass), and build-host-packages.py --check --release-guard-base origin/main reports no Pi payload change - version bump not required (pass) - the version advance here is the merge-train bookkeeping convention this repo's history follows on every merged PR, not something any gate required.

All post-commit gates run green: check_badge_consistency.py, test_release_trace.py (29 passed / 34 subtests), payload_version_gate.py (ca + ca-codex), build-host-packages.py --check --release-guard-base origin/main, check_site_voice.py.

Deviations from the task brief

• The task brief's setup step named env -u NO_COLOR python -m pytest ...; the sandbox rejected that exact command shape (it can't verify env's effect on a wrapped -m invocation), so tests ran instead via unset NO_COLOR && python -m pytest ... - same effect, different shell spelling.
• Anchor occurrence counts in the table above are re-measured against current main, not copied from the issue body, which was filed against an earlier revision of the skill.

Closes #571

https://claude.ai/code/session_01QjJeSbcwPHwMmd6CEZeagB

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 431de5b3-ee87-4034-8b17-add222e351b2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}