[1.8.0] Release TODOs and cross-repository integration checklist #3242

1.8.0 release checklist

Core: Server / Hubble / Loader / Client. Java 17 delivered. Rebuild and restage frozen RCs; 1.7 → 1.8 compatibility remains a release gate.

Checked = delivered, not RC accepted. CI/author tests/independent review differ from same-RC acceptance; old scores never transfer or waive CI/RC. Targeted refresh: Oct31 18:53 UTC; unchanged evidence retains its prior date/version. New scope is not admitted by this audit.

Pending

• Post-merge / scope undecided · Oct31

  • 🔗 Doc #555 · Static 8.9; live lifecycle pairing open.
  • 🔗 Doc #554 · API 0.73 edge-free; pairing/partial-target/concurrent-DDL acceptance open.
  • P2 · 🔗 Toolchain #880 · Merged; confirmed hidden rejection reasons. Safe diagnostics/write counts/uncertainty/no rollback must coexist.
  • Hubble/Loader/Client · import/partial failure, algorithms/readback, scope/lifecycle/cost unverified; acknowledgments ≠ unique inserts.
  • Deployment/clone · chart/image, auth/HStore, restart/recovery and same-RC open; merge admits no optional scope or gate waiver.

• New upstream Store / transport work · scope not yet admitted

• Server / PD / Store

  • Post-merge acceptance · 🔗 Server #3432 · Cgroup/memory-budget follow-up delivered; independent runtime/same-RC acceptance remains open; unscored.
  • 🔗 Server #3413 · gRPC allocator-property regression coverage; CI passes, runtime/RC open; unscored.
  • 🔗 Server #3414 · Logging dependency update; CI fails, cause/current review unverified; unscored.
  • 🔗 Server #3421 · Guava dependency update; CI fails, cause/current review unverified; unscored.
  • Post-merge acceptance · 🔗 Server #3418 · Split-lock P1 and Exiting Raft-address notification follow-up remain unresolved; merge is not RC acceptance.
  • Post-merge acceptance · 🔗 Server #3420 · Conditional trailing-segment recovery P2 remains; verify recovery separately from merge/CI.
  • P0 · 🔗 Server #3399 · Original head 827e6c19bbfa4c75bc706259d10e752fbb7bc3bd remains open/conflicting with Server memory CI failure. Follow-up #3473 is open at head: 15 checks pass/4 skip, but current-head blocking review reports ignored DB options / max_open_files, risking fd-limit startup failure. Author-reported LOCK/coverage/path/fixture repairs belong to fix(store): guard legacy GraphID upgrades #3473, not the unchanged original head; this audit did not reproduce them. Organization repair #372 is open at head, based on fix(store): guard legacy GraphID upgrades #3473: independent AGY source/post-fix suites report the DB-option defect fixed with no new findings; saved exact-repair-head Codex evidence is missing. Earlier combined-suite timeout and pre-fix attribution remain qualified in Cloud evidence; only CodeRabbit skipped, no build/test CI proof. This follow-up is not delivered upstream or team/RC accepted. Large-Store startup cost, [Bug] HStore: data written by 1.7.0 under the missing graph id 0xFFFE becomes unreachable once master allocates a real graph id #3224, migration/website/RC remain open. Historical Oct27 version: 15 checks passed/4 skipped; Docker/launcher repairs were reported at earlier version.
  • P0 · 🔗 Server #3330 · Draft; current CI failed, current review incomplete. Oct23 7.0/10 (prior 7.6) and Up-before-restoration concern remain historical. Refusal is not migration; [Bug] HStore: data written by 1.7.0 under the missing graph id 0xFFFE becomes unreachable once master allocates a real graph id #3224 remains.
  • P0 · HStore upgrade #3224 · require old-data reads, Raft replay, first allocation/write, per-replica rollback; refusal is not migration
  • P1 · Property-query · docs/live-backend RC pending
  • P1 · 🔗 Server #3192 · Conflicts; head. Nov10 exact-head review confirms conflicting duplicate-authenticator refusal fixed, with no blocking source finding; trailing-whitespace duplicate handling and paired YAML recovery guidance remain minor gaps, and Settings.read()/packaging simplification remains open. No current-head checks or workflow runs returned; this audit did not reproduce reviewer/author tests. YAML/image/config RC remains open.
  • P1 · 🔗 Server #3253 · Nov10 head conflicts; exact-head blocking review reports the Linux crontab lock-fd defect persists, Store/PD process matching accepts conf-directory substrings, and upstream history needs repair; PID-directory docs also mismatch start behavior. No current-head checks or workflow runs returned; prior CI approval request is historical. Override/restart/docs fixes are reviewer-reported; this audit did not reproduce shell tests. Oct21 5/10 remains historical; current unscored, prior HTTPS keystore/Spring/plugin findings remain unverified; cron/service/package/RC open.
  • P1 · Cypher API/Hubble · compatibility fixed; same-RC pending
  • P1 · Cypher date folding · backend/perf/scope/RC pending
  • P1 · Binary serializer #3225 · 🔗 Server #3375: mixed-version serializer blocker; header CI red; unscored
  • P2 · 🔗 Server #3377 · Spring dependency update: current servlet compile failure; runtime skipped
  • P2 · Metrics labels · repaired; live scrape/RC pending
  • P2 · V2 schema auth · OLAP deferred; HStore RC pending
  • P1 · Loading-owner · Loader/auth-HTTP/crash RC pending
  • P2 · Discovery identity · fixed; matching-image/live-PD RC pending
  • Post-merge acceptance · 🔗 Server #3429 · Cluster/same-RC acceptance remains open; final public approval and earlier revision-bound reviews do not close it.
  • Draft / excluded from active ranking · 🔗 Server #3430 · Nov1 head: official-source, dependency-license and Codecov patch fail (14 pass/4 skip); reviewer approval is separate. Prior static Store-reopen/source-deletion concern retained, not revalidated by this audit; migration decision/RC open.
  • P2 · Traversal follow-up #3346 · long-term; no new gate
  • Post-merge acceptance / scope undecided · 🔗 Server issue #3415 closed Oct29 by merged 🔗 #3424, recorded head and merge; 7 checks pass/9 skip. Explicit-gRPC dedup repair delivered; independent live/RC acceptance and any release-gate change remain undecided.

• Schema replacement · split dependencies

  • P1 · PD read/election RC · multi-PD/performance pending
  • P1 · Schema counter/auth-key · HStore CI pass; multi-server/restart RC pending
  • P1 · 🔗 Server #3376 · Oct29 version: product checks pass; codecov/project fails. Prior bounded replay/charset review is historical; current-head review/cluster/perf/RC unscored.
  • P1 · 🔗 Server #3382 · CI green; renewal race/malformed-key pass abort; real PD/RC open; model-only perf
  • P1 · 🔗 Server #3383 · Cluster dependency CI red; shared-worker risk acknowledged; quorum/perf/RC open
  • P1 · Watch/ACK · ASF PR pending; shutdown repair; multi-PD election/cost
  • P1 · Server cache integration · ASF PR pending; hold: name-miss refill churn

• Deployment / Hubble

  • P2 · PD health · fatal-Raft fixed; reinit/Compose/live-PD RC pending
  • P1 · 🔗 Server #3362 · Oct21 readiness 4/10; test compile/credential blockers; TTL/Secret/60s shutdown nonblock (OnDelete, 300s grace); RC
  • P2 · Helm OCI · metadata/name/signing delivered; signature/live-upgrade RC pending
  • P1 · Graph-binding recovery #3228 · repair merged; multi-PD startup/rollout, data/index retention, same-RC remain high priority
  • P1 · 🔗 Server #3221 · workflows pass; blocks: stale PD failures, empty Store list, HBase graphspace dedup; recovery/isolation/RC open
  • P2 · Per-Pod index · completed jobs/stable-schema/live-Pod RC pending
  • P2 · Docker PD registration · docs/image RC pending; writable-conf separate
  • P2 · Arthas · runtime/guide merged; interrupted-attach cleanup/package/RC pending

• Lifecycle / optional features

  • Optional / draft · 🔗 Server #3401 · Nov1 head: check-license fails, 15 checks pass/4 skip. Prior CRLF startup finding covers Oct27 693470e05e6e; Oct24 findings remain historical. Affected-scope repairs/current independent review not verified by this audit. Unscored, native/RC open.
  • Scope undecided · 🔗 Server #3388 · Serializer fallback fixed (static); CI 6 pass/7 skip; unscored, runtime/RC open. Prior review and fixture/CI failure are historical.
  • P2 · 🔗 Server #3359 · Oct21 readiness 4/10; test compile/leader-change failures; RC
  • P2 · PD metrics · registered-Store scrape/failed-refresh throttling pending
  • P2 · 🔗 Server #3356 · Interval repair submitted; core CI green/project red; current independent review/load/RC open (Oct21 8.5/10 historical)
  • P2 · 🔗 Server #3081 · Optional/unscored; Nov9 head, CI 16 pass/3 skip. Nov8 review at prior 1e09154dc9c7e96e342e2afcbdd6a8c0c06e08cd reports earlier fixes hold and truncate has no production caller; it does not review the new head. Oct31 purge/local-loss, native-handle and SST-cleanup findings plus retry-epoch concerns remain historical; affected-scope revalidation/live/RC are unverified by this audit.
  • P1 · RPC lifecycle · cleanup-retry identity/cross-Server/deployment/RC pending
  • P1 · Scan cancellation · request serialization delivered; latency/perf/RC unverified
  • P1 · Deletion RC · admission/retry/restart/cross-Server recovery
  • P1 · 🔗 Server #3299 · Nov3 head: CI succeeds, 8 checks pass/7 skip; exact-head source approval. Prior Arthas CLI failure is historical; native Topling/same-RC acceptance remains open.
  • P2 · Retryable restore acceptance · migration/rollback/native/RC

• Toolchain / clients

  • P2 · Toolchain release artifacts #821 · author-reported signing/source/Javadoc overlap; deduplication and signed local-release/source-archive smoke pending; no new release gate
  • P2 · Hubble smoke · fixture delivered; candidate/1.7 CI pass; immutable RC pending
  • P2 · Client/Loader · tests delivered; Server1.7/full integration/immutable RC pending
  • P2 · Loader/HDFS concurrency · 🔗 Toolchain #858 delivered as replacement for closed-unmerged 🔗 #710; immutable same-RC acceptance remains open
  • P2 · CI/image advisory #792 · cache/provenance + image/Compose smoke; no new gate

• Documentation · acceptance

  • Post-merge · 🔗 Doc #552 PPR omission remains after line wrapping; matched-runtime/RC open.
  • 🔗 Doc #547 · Periodic leader-balance guide has Nov3 exact-head source approval at cb41bf46ba8d69bb9445d7d8b08416b246649a68; site CI passes. Merge-order dependency 🔗 Server #3356 remains open; live-PD/same-RC acceptance remains open.
  • P2 · 🔗 Doc #543 · Oct30 review reports incorrect 1.0 navigation stats and remaining Compose/profile guidance; current-head CI fails. Independent runtime/RC open.
  • 🔗 Doc #541 · Post-merge API/runtime/RC unverified.
  • P2 · PD timeout guide · guide/runtime delivered; live-PD/RC pending
  • 🔗 Doc #535 · Post-merge recovery/RC with 🔗 Server #3355 unverified.
  • P2 · 🔗 Doc #532 · Oct30 version: prior nonblocking old-image probe/shared-credential/ambiguous-RPC review is historical; current-head review/unscored, CI authorization/RC open.
  • P0 · 🔗 Doc #523 · Draft; refusal wording narrowed, site CI passes; runtime draft/migration pending
  • P1 · Startup guide · docs/identity code delivered; package/RC pending
  • 🔗 Doc #503 · Post-merge query/runtime/RC unverified.
  • P1 · 🔗 Doc #498 · draft; align replacement behavior
  • P1 · Post-merge acceptance · 🔗 Doc #499 · Matching saved Codex provenance and API/Hubble/runtime/same-RC acceptance remain open; navigation/language documentation delivered.
  • P1 · Helm documentation · 🔗 Doc #494 closed unmerged Nov3, superseded by 🔗 Doc #560. Successor head 19b20c1bd3f05afe25206b80561aec21e716dcdc is open, site CI 6 pass/1 skip; navigation/optional-engine docs follow-up, current independent review unverified. Prior voter/shrink/operational acceptance and same-RC requirements remain open; closure is not delivery.
  • P1 · Deletion guide · config removal preserves backend; paired RC pending
  • Post-merge · 🔗 Doc #520: 🔗 #520 prior version-scope finding needs delivered-guide/package revalidation; same-instance URL/token/provider/RC open.
  • P2 · Java 17 client-guide repair · GraphBinary registry/builder example; paired API/RC
  • P2 · Diagnostics/Topling/Foundation guides · code delivered; package/RC pending
  • P2 · Helm guide · Server probe/live-Pod RC pending

• AI / integration / release

  • 🔗 AI #390 · Query-length limit proposal; current-head PR-triggered CI not found, independent review/compatibility/RC unverified; scope undecided.
  • 🔗 AI #391 · Ontogeny on still-open 🔗 AI #380; Nov9 head, CI 14 pass/1 skip. Author reports repairs for extraction/property coercion, document identity/reactivation, rejected candidates, run IDs and historical replay; current-head static follow-up found no new actionable findings only in data-consistency/historical-replay scopes, without independent tests or full-PR approval. Nov6 blocking review remains bound to prior 0e0b6aba37aa9eaac5f6f03983718c1e27de59d8. Repairs not reproduced by this audit; historical association/delivery gaps, explicit migration/backup/rollback, stopped-old-worker/single-process dispatch and live-runtime/RC remain open; scope undecided.
  • P2 · Vermeer acceptance · matched Computer/Hubble images, load cancellation, live-cluster/same-RC pending
  • P2 · Signed RC / staged-SDK · tooling/URL-hash fix delivered; match staging to frozen Server, then signed SVN RC/manual licensing
  • P2 · 🔗 AI #383 · Nov9 rebase head; no check contexts returned. Exact-head workflows are action_required and startup_failure; cause unverified. Author reports unchanged production code, 1,304 local Python3.14 tests passing and clean ruff; not independently reproduced. Prior approval/24 passing checks stay bound to 142fdf2f44d65c62c5af7aa0e795343841935eb9; current-head independent delta/live-Server/same-RC pending.
  • P2 · 🔗 AI #385 · Nov9 rebase head; no check contexts/reviews returned. Exact-head workflows are action_required and startup_failure; cause unverified. Escaping follow-up remains stacked on 🔗 AI #383; author parser evidence is separate from independent current-head/live/RC acceptance.
  • P2 · AI post-merge · 🔗 AI #372: conflict diagnostics (fake LLM); import/RC open
  • P1 · AI ingestion #373 · code/live-provider/GraphMCP gaps

• Reference to verify · Historical Server fix(pd): bound member lookups in RaftEngine.getMembers() #3409 was listed as completed, but neither its PR nor issue resolves. Identify the correct source before counting “Bound member lookups in RaftEngine.getMembers()” as delivered.

Delivery archive

Completed PRs and closed/replaced history: archive #3474. Only remaining work and acceptance are tracked here; merge does not complete runtime or same-RC validation.

Release decisions and acceptance boundaries

Existing acceptance, no new scope/gates. One frozen RC; merges, models, author probes, skips and prior RCs are insufficient.

• Upgrade / recovery
  • P0 · HStore #3224: verify old/new rows through snapshots, replay, first allocation/write and every-replica rollback. Reported 1 PD + 3 Store reproduction: old 0xFFFE rows become unreachable; JAR rollback does not repair mapping, and remapping may hide new-ID rows. Not proven permanent loss; independently verified migration/recovery required, refusal insufficient.
  • P1 · Recovery: old PD/Store data, init_store.enabled, binary serializer compatibility, credentials/prefixes, data/schema/index retention, metrics, backup/restore/rollback, empty-volume replacement/old-ID retirement and PD/DNS recovery. 🔗 Server #3265 synthetic SST/WAL/single-node tests do not qualify upgrades/failover.
  • P1 · Native lifecycle: ownership/failed cleanup, authenticated scan/TTL, timeout/PID, multi-replica restart, cleanup-retry identity and cross-Server deletion/recovery on matching packages. Serialization is not latency/performance acceptance.
• Query / schema / API
  • P1 · Query/index: nested/negative/count predicates; local/optional/coalesce/union/choose/map/flatMap/math; composite-index/deletion races; ordered partitions/scans, limits/offsets/pages/cursors and duplicate/missing rows. Upgrade all Stores before ordered-scan protocol; reject mixed versions. Retain Track HStore core-test exclusions and property codec mismatch #3090 codec/lifecycle exclusions and prior scans. EN/CN PRIMARY_KEY, parent-index and schema-visibility docs must match runtime.
  • P1 · Schema stack: PD-first/DDL freeze; leader-term IDs, rejected snapshots, elections, rollback/API/tasks and multi-Server restart. Resolve partial-init/concurrent-start and CREATING/recreated-graph drop races; name-miss cache churn stays on hold. Watch shutdown/double-close/plain-write repairs and author probes do not qualify multi-PD/cost.
  • P1 · Cypher (🔗 Server #3289): preserve parser/error/legacy-success contracts with Hubble. Seventeen $props.field values are not top-level parameters (cap16); CREATE (n:label $props) sets no PK. Verify ID strategy/schema, required properties, parallel-edge errors, rounding/CN examples and migration E2E. Null-binding no-row applies only to equality. Advanced HStore/Bolt, cross-request transactions and performance unqualified.
  • P2 · Java/TP (🔗 Server #3263, 🔗 Server #3261; 🔗 Server #3117 historical): Java17 build/services, Commons/RPC Java11 bytecode; TP3.8.1/Groovy4.0.25 default Gremlin, GraphBinary Schema/Blob, HTTP V1 Tree, caller-owned GValue, String-ID/count/DATE. Qualify API/Structure/Process on Memory/RocksDB/HStore, single/multi-cluster, downstream clients/tools/Computer, mounted config and old data. Prior TP skips, PD memory/swap and GraphID scaling close neither cause nor [Bug] HStore: data written by 1.7.0 under the missing graph id 0xFFFE becomes unreachable once master allocates a real graph id #3224.
  • P2 · Foundation/OLAP (🔗 Server #3305, 🔗 Server #3306): source-only null-graph edge-deserialization, namespace/rebuild/long-text/OLAP acceptance and null-graph regression disposition. Shared imports/process-wide namespace/clean-output delivery does not qualify downstream migration. Quiesce affected OLAP writes through cleanup; no concurrent-writer guarantee.
• Deployment / identity / diagnostics
  • P1 · Graph-binding #3228: high priority despite repair/closure. Verify multi-PD/Server rollout, password rotation, data/index retention, retained-PVC reconnect and independent Hubble login/list/query/logout. Retries must expose failure; NetworkPolicy must bound offline allocation. An observed stall is not proof of timeout expiry.
  • P1 · Readiness: metadata-graph failures/failedGraphs, stale failures, empty Stores, HBase GraphSpace dedup, k3s/default budgets, data-before-Up, truthful tasks/manual restore. Ping is not Raft/data proof; distinguish fatal PD from transient quorum loss. Never delete LOCK. Verify password caches, native/JVM limits and offline startup.
  • P1 · Helm: one Leader/only Followers; minStoreCount=replicas may prevent Store retirement. Verify EN/CN growth/PDB/PD-roll/balance, additive NetworkPolicy, Secret/password/auth-cache rollout and corrected 30-minute Tombstone handling. Chart delivery does not qualify live probes, completed jobs/stable schema, OCI signatures/upgrades or published images.
  • P1 · Credentials: reject controls in both fields and username colons; allow password colons and ordinary spaces/commas. Align create/update/login and reject unsupported values before saving. Broader ASCII-only policy undecided; no new gate. Basic standard Base64 decoder repair is separate from 🔗 Server #3281 UTF-8 consumers; [Feature] Let the Server take the initial admin password without a properties-file round trip #3285/[Feature] Server image: map server.urls_to_pd and server.deploy_in_k8s from the environment, and stop editing conf files in place #3286 excluded from 1.8.
  • P1 · Startup/auth/diagnostics: mounted YAML/auth/image, JVM options before -jar, PID/path/plugin/cron/restart, authenticated HStore and OOM/volume retention. Recheck explicit/default G1 compatibility, quote/% fallback and same-launch PID reuse. Prior RISC-V/macOS failures establish no cause; Store hostname/address changes require PD–Raft/network RC, not skipped tests.
  • P1 · HTTPS identity (🔗 Server #3307): default hostname verification repaired; strict-JDK/no-SAN distinction remains relevant. Packaged/downstream truststore/reflection and RC acceptance required; successful HTTPS alone is not identity proof.
• Toolchain / compatibility / imports
  • P1 · Compatibility matrix: tools ↔ Server 1.7; Hubble ↔ 1.5; measure other tools ↔ 1.5 and original Client 1.5/1.7 ↔ candidate, JVM/route limits. REST/Gremlin/PD, nondefault GraphSpace, unauthorized rejection, timeout units, concurrent FILE/HDFS/JDBC/Kafka and old plain/ZIP local/HDFS restore remain.
  • P1 · Hubble adaptation (🔗 Toolchain #781): backup-first/read-only H2 refusal, no migration. Qualify browser/package/public coordinates, metadata/restart, EN/CN permissions, anonymous/login and graph/schema/query/import with separate Server/PD auth. Shutdown repair does not qualify async Cypher.
  • P1 · Import (🔗 Toolchain #783; HBase outside tested scope): recheck clearGraph/PD schema, OLAP ALL-read, Project decode/cast/missing IndexLabel, stale cross-entry reads and observer authorization; independent per-ID deletion checks, no established cache/storage cause. POST201 and encoded GET/DELETE pass; only unencoded GET500. Retest authenticated API, K12/K14/K23/K24 failures and L09/L30 partials over HTTP/original topology/mainline. SDK/FILE/auth subsets and delivered vertex/worker/scan repairs do not qualify the release.
  • P2 · SDK/artifacts (🔗 Toolchain #784, 🔗 Toolchain #787, 🔗 Toolchain #794): immutable SDK/JAR/native/UTF-8 pins, remote staging/POMs, isolated consumers, SDK1.8/dist coordinates, archive fallback and Go/Python selection; match signed Server RC. READ_LIMIT, configured-zone DATE/local TIMESTAMP and Protobuf3.25.9/Parquet delivered; INT96 remains JVM-zone. PD/GraphSource import is not native GRAPH CLI acceptance; error-swallowing/--clean deferred.
  • P2 · CI/image advisory: same-run SDK/provenance-cache savings and final Loader image/Compose tiny import/readback; no new gate. Post-merge stale-input guards are not product-test failures; RAT/green unit counts do not establish functional acceptance or add to the live matrix.
• Optional scope / integrations
  • Scope undecided · Spark/Flink/Topling/text2gql; ordinary Loader independent. 🔗 AI #380: new head unscored; CI passes, not security proof; budget/filter/rollback review open. Ranger [RFC] Apache Ranger Authorization Plugin for HugeGraph #3240 remains roadmap.
  • Low priority · 🔗 Server #3381: non-root digest/GID repair, CI green; PVC/RC remain.
  • Optional acceptance · Spark: CSV/IDs, UTF-8 FILE/HDFS CSV/JSON/TEXT, zero-write dry-run/nonzero CLI errors, extra JARs, serialization/routing/header checks; unsupported resume/standalone-cluster modes rejected, basename collision handling relies on Spark. Driver/executor/YARN, distributed/TLS/license/HBase/readback RC remain.
  • Optional acceptance · Flink: reject identity-changing UPDATE before buffers/writes; same-ID UPDATE and READ/CREATE/DELETE work, DELETE+CREATE non-atomic. JM/TM/CDC/recovery, duplicates/missing rows, edge/HStore/TLS/license RC remain. Toolchain #793 atomic migration/UNIQUE/incident-edge/compensation is retained without a new gate.
  • Optional acceptance · Topling/restore (🔗 Server #3275): owning-DB handles, clearing-thread discard, cold/live-base identity, quiesced retry, hard-links/old pending state, standard provider and copied data/WAL durability. Parent sync preserves retry; nested data/WAL rejection withdrawn. Qualify JNI/image/legal, restart/migration/rollback, empty/persistent WAL, cross-UID/HA/old format and per-graph roots. Standard/unsafe JNI probes are insufficient; [Bug] HStore: data written by 1.7.0 under the missing graph id 0xFFFE becomes unreachable once master allocates a real graph id #3224 remains.
  • P1 · AI/GraphMCP: controlled writes/replay/credentials, Python SDK first; live-provider/import/lifespan/background refresh/database identity and matching RC. Fake LLM/endpoints do not establish live-provider acceptance. SeaTunnel 3.0.0 is released (official downloads); use matching plugins and retain migration E2E.
• Release qualification
  • Decision pending · 🔗 Server #3404: hash/equality repair; CI approval pending, unscored; 🔗 #3404 Oct24 nonblocking review: downstream key mutation still defeats id-only dedup; sorted/per-source semantics remain. Scope/owner/new gate undecided; live-Store/RC open.
  • P1 · Freeze scope/owners/revisions; security/LICENSE/NOTICE, platforms, bilingual upgrade tests and signed RC. Rebuild/restage: prior four-platform/six-signature/SHA512, staging-origin and source/binary-smoke evidence predates current components. Five license/content notes, upgrade/rollback and HA remain; logs reviewed, not rerun.