Cut 0.2.1: the published 0.2.0 predates both of this window's fixes — it ships an unvalidated path input, a `--dry-run` that writes, and the unbounded chunk scan

[sroussey]

@workglow/sec@0.2.0 was published 2026-09-08T22:27:24Z from 7942d736. The two fix commits
landed the next day:

$ git log --format='%h %ci %s' 2ab82ba..6d9ee18 | tac | tail -3
7942d736 2026-09-08 22:22:41 +0000  chore: release @workglow/sec@0.2.0
532f61d2 2026-09-09 19:30:59 +0100  fix(adv): bound the ingest folder and keep the newest filing per CRD (#363)
6d9ee187 2026-09-09 19:31:19 +0100  fix(kb): honour --dry-run when indexing, and page the chunk scan (#364)
$ npm view @workglow/sec version
0.2.0

So the build an installer gets today still has, by each commit's own description:

• IngestAdvSnapshotTask joining SEC_RAW_DATA_FOLDER with a completely unvalidated folder —
  "any local *.csv could be read into adv_row" — and snapshot unvalidated when folder is
  supplied, so "a chosen snapshot label wiped a real one through the deleteSearch that runs
  first". Reachable from sec-base task run, the web console form and the MCP tool surface.
• sec index --dry-run and sec ask --dry-run committing kb_document and kb_chunk rows —
  after runCommand has printed "Dry run — no data will be written".
• SELECT * FROM kb_chunk with no bound per question, hydrating the whole index to score one
  query.

Also missing from 0.2.0: the newest-filing-per-CRD reduction, so adv_adviser on the cumulative
archive keeps whichever amendment the CSV happened to list last and sec show advisers --min-aum
filters on an arbitrary historical AUM.

None of these is a regression introduced by 0.2.0 — they are all older — but the release sits
between the review that found them and the commits that fixed them, which is the one window where
cutting a patch costs nothing and buys everything.

24025a60 made this a single command, and bunset --auto will derive patch from two fix:
commits with no break markers:

bun run release

Suggested as a standing habit rather than a one-off: when a release lands before the fixes for
the defects its own changelog window surfaced, the follow-up patch is part of the fix, not a
separate decision.

Found during the 2026-09-14 review. Snapshot: workglow-dev/prd → analysis/grades/2026-09-14/sec-detailed.md §5.2.