fix: compose release document normalization

[tensornull]

Why

A fresh adversarial review found that release-document parsing still admitted renderer-dependent encodings and destinations, while immutable-tag builds did not independently repeat the copied-repository gate. Artifact parity also needed to reject archive ambiguity.

What

• compose bounded NFKC, entity, percent, Markdown escape, tab/newline, control/default-ignorable, and backslash normalization before Actions identity comparison
• parse raw and normalized evidence independently, require exactly one base publication-run URL, and reject duplicate, attempt-suffixed, fullwidth, wrapped, reused, hidden, malformed, or contradictory destinations
• retain historical attempt provenance as plain text while preserving each exact tag, commit, base run, date, digest, and registry identity
• reject raw HTML H2 changelog headings, including form-feed separators, so canonical Release Please Markdown history remains deterministic
• lazily load optional parser/TOML dependencies so the copied checkout can bootstrap under Python 3.10 with -S
• require byte-for-byte parity for every reviewed sdist source member and reject duplicate normalized wheel/sdist paths
• run copied standalone verification in the immutable-tag build after clean artifact installs and before digest retention

Verification

• uv sync --locked
• Ruff check and format check
• Pyright strict
• full non-live pytest: 775 passed, 1 deselected
• version, public-preview, releasable-docs, secret, and workflow semantic checks
• actionlint 1.7.12
• wheel/sdist build, twine check, artifact inspection, independent clean installs, and all four README examples
• copied standalone verification: 775 passed, 1 deselected; build/artifact/clean-install gates passed
• OpenAI 2.45.0 locked/minimum and 2.51.0 latest-within-major: 775 passed, 1 deselected each; locked environment restored
• adversarial encoded-control suite through depth 128, NFKC/fullwidth, URL-cardinality, raw-H2 form-feed, and duplicate archive-member regressions
• git diff --check

This remains release-blocking follow-up. Do not merge release PR #38 until exact head 2ee1f65c5ae40dc2d76564d6d4dac3247b09346b passes and PR #40 is merged.

[tensornull]

Why

A fresh adversarial review found that release-document parsing still admitted renderer-dependent encodings and destinations, while immutable-tag builds did not independently repeat the copied-repository gate. Artifact parity also needed to reject archive ambiguity.

What

• compose bounded NFKC, entity, percent, Markdown escape, tab/newline, control/default-ignorable, and backslash normalization before Actions identity comparison
• parse raw and normalized evidence independently, require exactly one base publication-run URL, and reject duplicate, attempt-suffixed, fullwidth, wrapped, reused, hidden, malformed, or contradictory destinations
• retain historical attempt provenance as plain text while preserving each exact tag, commit, base run, date, digest, and registry identity
• reject raw HTML H2 changelog headings, including form-feed separators, so canonical Release Please Markdown history remains deterministic
• lazily load optional parser/TOML dependencies so the copied checkout can bootstrap under Python 3.10 with -S
• require byte-for-byte parity for every reviewed sdist source member and reject duplicate normalized wheel/sdist paths
• run copied standalone verification in the immutable-tag build after clean artifact installs and before digest retention

Verification

• uv sync --locked
• Ruff check and format check
• Pyright strict
• full non-live pytest: 775 passed, 1 deselected
• version, public-preview, releasable-docs, secret, and workflow semantic checks
• actionlint 1.7.12
• wheel/sdist build, twine check, artifact inspection, independent clean installs, and all four README examples
• copied standalone verification: 775 passed, 1 deselected; build/artifact/clean-install gates passed
• OpenAI 2.45.0 locked/minimum and 2.51.0 latest-within-major: 775 passed, 1 deselected each; locked environment restored
• adversarial encoded-control suite through depth 128, NFKC/fullwidth, URL-cardinality, raw-H2 form-feed, and duplicate archive-member regressions
• git diff --check

This remains release-blocking follow-up. Do not merge release PR #38 until exact head 2ee1f65c5ae40dc2d76564d6d4dac3247b09346b passes and PR #40 is merged.

[tensornull]

Why

A fresh adversarial review found that release-document parsing still admitted renderer-dependent encodings and destinations, while immutable-tag builds did not independently repeat the copied-repository gate. Artifact parity also needed to reject archive ambiguity.

What

• compose bounded NFKC, entity, percent, Markdown escape, tab/newline, control/default-ignorable, and backslash normalization before Actions identity comparison
• parse raw and normalized evidence independently, require exactly one base publication-run URL, and reject duplicate, attempt-suffixed, fullwidth, wrapped, reused, hidden, malformed, or contradictory destinations
• retain historical attempt provenance as plain text while preserving each exact tag, commit, base run, date, digest, and registry identity
• reject raw HTML H2 changelog headings, including form-feed separators, so canonical Release Please Markdown history remains deterministic
• lazily load optional parser/TOML dependencies so the copied checkout can bootstrap under Python 3.10 with -S
• require byte-for-byte parity for every reviewed sdist source member and reject duplicate normalized wheel/sdist paths
• run copied standalone verification in the immutable-tag build after clean artifact installs and before digest retention

Verification

• uv sync --locked
• Ruff check and format check
• Pyright strict
• full non-live pytest: 775 passed, 1 deselected
• version, public-preview, releasable-docs, secret, and workflow semantic checks
• actionlint 1.7.12
• wheel/sdist build, twine check, artifact inspection, independent clean installs, and all four README examples
• copied standalone verification: 775 passed, 1 deselected; build/artifact/clean-install gates passed
• OpenAI 2.45.0 locked/minimum and 2.51.0 latest-within-major: 775 passed, 1 deselected each; locked environment restored
• adversarial encoded-control suite through depth 128, NFKC/fullwidth, URL-cardinality, raw-H2 form-feed, and duplicate archive-member regressions
• git diff --check

This remains release-blocking follow-up. Do not merge release PR #38 until exact head 2ee1f65c5ae40dc2d76564d6d4dac3247b09346b passes and PR #40 is merged.

[tensornull]

Why

A fresh adversarial review found that release-document parsing still admitted renderer-dependent encodings and destinations, while immutable-tag builds did not independently repeat the copied-repository gate. Artifact parity also needed to reject archive ambiguity.

What

• compose bounded NFKC, entity, percent, Markdown escape, tab/newline, control/default-ignorable, and backslash normalization before Actions identity comparison
• parse raw and normalized evidence independently, require exactly one base publication-run URL, and reject duplicate, attempt-suffixed, fullwidth, wrapped, reused, hidden, malformed, or contradictory destinations
• retain historical attempt provenance as plain text while preserving each exact tag, commit, base run, date, digest, and registry identity
• reject raw HTML H2 changelog headings, including form-feed separators, so canonical Release Please Markdown history remains deterministic
• lazily load optional parser/TOML dependencies so the copied checkout can bootstrap under Python 3.10 with -S
• require byte-for-byte parity for every reviewed sdist source member and reject duplicate normalized wheel/sdist paths
• run copied standalone verification in the immutable-tag build after clean artifact installs and before digest retention

Verification

• uv sync --locked
• Ruff check and format check
• Pyright strict
• full non-live pytest: 775 passed, 1 deselected
• version, public-preview, releasable-docs, secret, and workflow semantic checks
• actionlint 1.7.12
• wheel/sdist build, twine check, artifact inspection, independent clean installs, and all four README examples
• copied standalone verification: 775 passed, 1 deselected; build/artifact/clean-install gates passed
• OpenAI 2.45.0 locked/minimum and 2.51.0 latest-within-major: 775 passed, 1 deselected each; locked environment restored
• adversarial encoded-control suite through depth 128, NFKC/fullwidth, URL-cardinality, raw-H2 form-feed, and duplicate archive-member regressions
• git diff --check

This remains release-blocking follow-up. Do not merge release PR #38 until exact head 2ee1f65c5ae40dc2d76564d6d4dac3247b09346b passes and PR #40 is merged.

[tensornull]

Why

A fresh adversarial review found that release-document parsing still admitted renderer-dependent encodings and destinations, while immutable-tag builds did not independently repeat the copied-repository gate. Artifact parity also needed to reject archive ambiguity.

What

• compose bounded NFKC, entity, percent, Markdown escape, tab/newline, control/default-ignorable, and backslash normalization before Actions identity comparison
• parse raw and normalized evidence independently, require exactly one base publication-run URL, and reject duplicate, attempt-suffixed, fullwidth, wrapped, reused, hidden, malformed, or contradictory destinations
• retain historical attempt provenance as plain text while preserving each exact tag, commit, base run, date, digest, and registry identity
• reject raw HTML H2 changelog headings, including form-feed separators, so canonical Release Please Markdown history remains deterministic
• lazily load optional parser/TOML dependencies so the copied checkout can bootstrap under Python 3.10 with -S
• require byte-for-byte parity for every reviewed sdist source member and reject duplicate normalized wheel/sdist paths
• run copied standalone verification in the immutable-tag build after clean artifact installs and before digest retention

Verification

• uv sync --locked
• Ruff check and format check
• Pyright strict
• full non-live pytest: 775 passed, 1 deselected
• version, public-preview, releasable-docs, secret, and workflow semantic checks
• actionlint 1.7.12
• wheel/sdist build, twine check, artifact inspection, independent clean installs, and all four README examples
• copied standalone verification: 775 passed, 1 deselected; build/artifact/clean-install gates passed
• OpenAI 2.45.0 locked/minimum and 2.51.0 latest-within-major: 775 passed, 1 deselected each; locked environment restored
• adversarial encoded-control suite through depth 128, NFKC/fullwidth, URL-cardinality, raw-H2 form-feed, and duplicate archive-member regressions
• git diff --check

This remains release-blocking follow-up. Do not merge release PR #38 until exact head 2ee1f65c5ae40dc2d76564d6d4dac3247b09346b passes and PR #40 is merged.

[tensornull]

Why

A fresh adversarial review found that release-document parsing still admitted renderer-dependent encodings and destinations, while immutable-tag builds did not independently repeat the copied-repository gate. Artifact parity also needed to reject archive ambiguity.

What

• compose bounded NFKC, entity, percent, Markdown escape, tab/newline, control/default-ignorable, and backslash normalization before Actions identity comparison
• parse raw and normalized evidence independently, require exactly one base publication-run URL, and reject duplicate, attempt-suffixed, fullwidth, wrapped, reused, hidden, malformed, or contradictory destinations
• retain historical attempt provenance as plain text while preserving each exact tag, commit, base run, date, digest, and registry identity
• reject raw HTML H2 changelog headings, including form-feed separators, so canonical Release Please Markdown history remains deterministic
• lazily load optional parser/TOML dependencies so the copied checkout can bootstrap under Python 3.10 with -S
• require byte-for-byte parity for every reviewed sdist source member and reject duplicate normalized wheel/sdist paths
• run copied standalone verification in the immutable-tag build after clean artifact installs and before digest retention

Verification

• uv sync --locked
• Ruff check and format check
• Pyright strict
• full non-live pytest: 775 passed, 1 deselected
• version, public-preview, releasable-docs, secret, and workflow semantic checks
• actionlint 1.7.12
• wheel/sdist build, twine check, artifact inspection, independent clean installs, and all four README examples
• copied standalone verification: 775 passed, 1 deselected; build/artifact/clean-install gates passed
• OpenAI 2.45.0 locked/minimum and 2.51.0 latest-within-major: 775 passed, 1 deselected each; locked environment restored
• adversarial encoded-control suite through depth 128, NFKC/fullwidth, URL-cardinality, raw-H2 form-feed, and duplicate archive-member regressions
• git diff --check

This remains release-blocking follow-up. Do not merge release PR #38 until exact head 2ee1f65c5ae40dc2d76564d6d4dac3247b09346b passes and PR #40 is merged.

[tensornull]

Why

A fresh adversarial review found that release-document parsing still admitted renderer-dependent encodings and destinations, while immutable-tag builds did not independently repeat the copied-repository gate. Artifact parity also needed to reject archive ambiguity.

What

• compose bounded NFKC, entity, percent, Markdown escape, tab/newline, control/default-ignorable, and backslash normalization before Actions identity comparison
• parse raw and normalized evidence independently, require exactly one base publication-run URL, and reject duplicate, attempt-suffixed, fullwidth, wrapped, reused, hidden, malformed, or contradictory destinations
• retain historical attempt provenance as plain text while preserving each exact tag, commit, base run, date, digest, and registry identity
• reject raw HTML H2 changelog headings, including form-feed separators, so canonical Release Please Markdown history remains deterministic
• lazily load optional parser/TOML dependencies so the copied checkout can bootstrap under Python 3.10 with -S
• require byte-for-byte parity for every reviewed sdist source member and reject duplicate normalized wheel/sdist paths
• run copied standalone verification in the immutable-tag build after clean artifact installs and before digest retention

Verification

• uv sync --locked
• Ruff check and format check
• Pyright strict
• full non-live pytest: 775 passed, 1 deselected
• version, public-preview, releasable-docs, secret, and workflow semantic checks
• actionlint 1.7.12
• wheel/sdist build, twine check, artifact inspection, independent clean installs, and all four README examples
• copied standalone verification: 775 passed, 1 deselected; build/artifact/clean-install gates passed
• OpenAI 2.45.0 locked/minimum and 2.51.0 latest-within-major: 775 passed, 1 deselected each; locked environment restored
• adversarial encoded-control suite through depth 128, NFKC/fullwidth, URL-cardinality, raw-H2 form-feed, and duplicate archive-member regressions
• git diff --check

This remains release-blocking follow-up. Do not merge release PR #38 until exact head 2ee1f65c5ae40dc2d76564d6d4dac3247b09346b passes and PR #40 is merged.

[tensornull]

Why

A fresh adversarial review found that release-document parsing still admitted renderer-dependent encodings and destinations, while immutable-tag builds did not independently repeat the copied-repository gate. Artifact parity also needed to reject archive ambiguity.

What

• compose bounded NFKC, entity, percent, Markdown escape, tab/newline, control/default-ignorable, and backslash normalization before Actions identity comparison
• parse raw and normalized evidence independently, require exactly one base publication-run URL, and reject duplicate, attempt-suffixed, fullwidth, wrapped, reused, hidden, malformed, or contradictory destinations
• retain historical attempt provenance as plain text while preserving each exact tag, commit, base run, date, digest, and registry identity
• reject raw HTML H2 changelog headings, including form-feed separators, so canonical Release Please Markdown history remains deterministic
• lazily load optional parser/TOML dependencies so the copied checkout can bootstrap under Python 3.10 with -S
• require byte-for-byte parity for every reviewed sdist source member and reject duplicate normalized wheel/sdist paths
• run copied standalone verification in the immutable-tag build after clean artifact installs and before digest retention

Verification

• uv sync --locked
• Ruff check and format check
• Pyright strict
• full non-live pytest: 775 passed, 1 deselected
• version, public-preview, releasable-docs, secret, and workflow semantic checks
• actionlint 1.7.12
• wheel/sdist build, twine check, artifact inspection, independent clean installs, and all four README examples
• copied standalone verification: 775 passed, 1 deselected; build/artifact/clean-install gates passed
• OpenAI 2.45.0 locked/minimum and 2.51.0 latest-within-major: 775 passed, 1 deselected each; locked environment restored
• adversarial encoded-control suite through depth 128, NFKC/fullwidth, URL-cardinality, raw-H2 form-feed, and duplicate archive-member regressions
• git diff --check

This remains release-blocking follow-up. Do not merge release PR #38 until exact head 2ee1f65c5ae40dc2d76564d6d4dac3247b09346b passes and PR #40 is merged.