[acamarata]

D-0715 (fixed)

• validateJournal now applies the runtimeRunID charset (^[a-zA-Z0-9-]+$) to the journal run_id, so a hand-edited journal cannot put spaces, shell metacharacters or separators into the printed archive guidance or the archive file name.
• E139 DefaultFix now includes the archive step (move .nself/state/update-stack.json to .nself/state/update-stack.<run_id>.json); error-codes.md regenerated with tools/wikigen.
• Not done: the optional Windows nested-file Lstat/parent check (row marks it optional).
• Tests: three new TestJournalRejectsContradictoryResume cases and TestE139DefaultFixIncludesArchiveStep; they failed before the fix (checked).

D-0727 (fixed)

• release-create.sh skips DENY-001/002 with a note when there is no dist/ (they stay enforced post-build by release.yml), and DENY-004 reads the license-audit run on main only.
• New scripts/release-create_test.sh (fake gh, throwaway repo): 3 of 4 checks failed on the old script, all pass now.

D-0806 (fixed, nightly run not verified here)

• scripts/e2e/pgvector-switch.sh takes POSTGRES_VERSION (major, default 16, unchanged behaviour) and asserts the start image and the pgvector target are of that major.
• New .github/workflows/pgvector-switch-e2e.yml: nightly 03:45 UTC, matrix 15 and 17, also runs on PRs touching the script or the workflow.
• The worker has no Docker, so the script has not run on 15 or 17; this PR's own run is the first. A failure there is a real finding about that major, not necessarily a bug in the change.

Not in this PR

• D-0769, D-1051, D-0705: blocked (see the run report).

Checks

• go test -mod=vendor ./internal/upgrade/... ./internal/errs/ ./tools/wikigen/ ./cmd/nself/ ./internal/repoqa/: 483 passed
• go vet on touched packages, wikigen -check: clean
• bash scripts/release-create_test.sh: 4 passed; actionlint on the new workflow: clean; bash -n on the e2e script: ok

[acamarata]

Fixed review finding CHANGES-1: scripts/release-create.sh now requires verified artifacts (dist/ with signatures + SBOMs) before allowing a non-draft gh release create. DENY-001 and DENY-002 no longer skip when dist/ is absent; --draft releases are exempt so the orchestrator can open the release shell first. An explicit guard also blocks non-draft publishes without dist/. Updated the no-dist test to expect the block and added a draft-path test. Commit c34a525.

[acamarata]

Review fixes in 78e178c: release-create.sh now follows the D-0727 row's first option. With no dist/ DENY-001/002 are skipped with a note (draft or not), the unconditional non-draft guard and the IS_DRAFT special case are gone, so --skip-denylist works at tag time again; with dist/ present both rules are still enforced. Header docs, code and the PR body now agree. Case 1a asserts the exact outcome (rc 0, both skip notes, 'denylist: PASS', gh release create invoked); against the previous script 2 of 4 checks fail, all 4 pass now. Also moved the errs import into its own group in journal_test.go. go test ./internal/upgrade/... and gofmt/vet are clean.

[acamarata]

Reworded Release-Process.md:61. It no longer says release-create.sh would always refuse at tag time. It now says the script skips DENY-001/002 with a note when dist/ is absent and enforces them when dist/ is present (39b56b8). The change is docs only, so I ran no tests.

[acamarata]

Rebased onto origin/main; TestPackageSizeBudget now passes locally (internal/plugin is within ceiling after main moved). Force-pushed bf0eb09 to dw9-cli-16.