[jayden1711]

Intent: The owner decided on 2026-10-19 that nothing is released until everything is done, and that the CHANGELOG keeps one unreleased section. #828 dated that section as ## v0.5.3 (2026-10-19). This PR puts it back to ## v0.5.3 (unreleased). package.json stays at 0.5.3.

Risk class: docs-only. Only CHANGELOG.md changes. It isn't in .worklane/review.yaml or src/review.ts (measured: grep -rn CHANGELOG .worklane src/review.ts finds nothing).

What changed

• The heading reads ## v0.5.3 (unreleased) again.
• Release v0.5.3: changelog and version [PROTECTED: owner merges] #828's generated lists are removed until the release: ### Features, ### Fixes, ### Security and guardrails, and the PR lines under ### Guardrail changes (122 lines). An empty ### Guardrail changes heading stays after the hand-written notes, as the closing heading the release keeps them above.
• Every hand-written line is unchanged.

Why the lists went (measured)

• With only the heading undated, test/changelog.test.ts "an unreleased section is all hand-written, so the release keeps every line of it, under any heading" failed: 7 pass, 1 fail.
• An unreleased section counts as all hand-written, so the test listed Release v0.5.3: changelog and version [PROTECTED: owner merges] #828's generated lines as lines the release would drop, starting with - Pin the engine to v0.5.2 (#578).
• The test is unchanged.

The release regenerates them (measured)

• Main's scripts/lib/changelog.mjs was run in memory, with no writes. Fed the 108 PRs the removed lines name (titles, numbers, and guardrail files from the removed lines), changelogSection('0.5.3', …) writes exactly the removed block: 123 lines, identical and in the same order.
• 0 removed lines fall outside main's generated block, and 0 removed lines have a shape the lib doesn't write.
• groupOf puts every PR in the group it was listed under.
• node scripts/release.mjs changelog 0.5.3 writes them again when the owner cuts the release.

How it was verified

All measured, in the worktree, against origin/main 71316eb.

• git diff --stat origin/main -- CHANGELOG.md: 1 insertion, 123 deletions. The one added line is the heading. The deleted lines are the old heading and the 122 generated lines.
• Release regeneration on this tree, using withSection(text, '0.5.3', changelogSection('0.5.3', …)) in memory: all 148 hand-written lines are kept, with both 0 and 1 PR. The only other line, the empty ### Guardrail changes heading, is kept too.
• node --import ./dist/test/isolate.js --test dist/test/changelog.test.js dist/test/comment-policy-cli.test.js: 15 pass, 0 fail. That includes all 10 changelog tests.
• owner-terminal-removed:
  • Its other tests set PATH to <bin>:/usr/bin:/bin with stand-ins for sudo, bash and id only, so CI runs them.
  • Only its CHANGELOG-reading test ran locally (--test-name-pattern="one placeholder version"), and it spawns nothing: 1 pass.
• test/release.test.ts wasn't run locally (it signs throwaway tags). CI runs it.
• npm run check:denylist: 1309 files clean.

Adversarial pass

• Does the release lose a hand-written line? No (measured): 148 of 148 are kept. "Guardrail changes: what each one does" is a heading the tool never writes, so its notes count as hand-written and are kept.
• Was a hand-written line removed with the lists? No (measured): regenerating from the removed lines alone reproduces them exactly, and none has a non-generated shape.
• Does undating break the check-comments docs pin? No (measured): comment-policy-cli passes 5 of 5. An "(unreleased)" section isn't a release, and 0.5.3 is the next release after 0.5.2.
• Does it reopen anything for an existing install? No (inferred): no code, config or packaged file changes.

Package size

No change: 0 bytes (measured). CHANGELOG.md isn't in the package: npm pack --dry-run --json lists no CHANGELOG entry (473 entries).

New dependencies

None.

[jayden1711]

Evaluator verdict: PASS

Head 54b3eb1, base 71316eb. Independent review. I didn't write this PR.

Merge condition (not a change to the PR): CI on 54b3eb1 is red in one job, test shard 3/4 (ubuntu-latest, 22), and so in its roll-up test (ubuntu-latest, 22). The cause is the runner, not this PR (measured, from the job log): sudo apt-get update got 403 Forbidden from packages.microsoft.com (E: The repository 'https://packages.microsoft.com/ubuntu/24.04/prod noble InRelease' is no longer signed.), and then sudo: /usr/bin/bwrap: command not found. That happened in the machine-setup step, before any test ran. The other 7 shards passed, including all four Node 24 shards, so every test file ran green on Node 24. This is run attempt 1. Merge only after the failed job is rerun and comes back green. I don't rerun CI.

What the owner decision asked for (2026-10-19: no release until everything is done, one unreleased section)

Check	Result	Evidence
Only CHANGELOG.md changes	met (measured)	git diff --stat 71316ebd 54b3eb1a: CHANGELOG.md | 124, 1 insertion, 123 deletions
The only added line is the heading ## v0.5.3 (unreleased)	met (measured)	the diff's only + line
No hand-written line removed	met (measured)	Line by line, from base's ## v0.5.3 heading to ### Features, compared with head's heading to the closing ### Guardrail changes: identical, 163 lines each, 148 non-blank. Every other section of the file is byte-identical.
The removed block is exactly main's generated output	met (measured)	See the regeneration check below.
A release regeneration keeps every hand-written line	met (measured)	See the regeneration check below.
changelog.test.ts 10/10, no test changed	met (measured)	10 ok, 0 fail; the diff touches no test
package.json stays 0.5.3	met (measured)	not in the diff

Regeneration check (measured)

I ran main's scripts/lib/changelog.mjs, read with git show origin/main:... and imported in memory from a data: URL. Nothing was written to any repo. main hasn't touched CHANGELOG.md, scripts/lib/changelog.mjs or test/changelog.test.ts since 71316eb (git log 71316ebd..origin/main -- <those> is empty).

• Base's v0.5.3 lines from ### Features to the section end parse to 108 PRs. 0 lines fail to parse as a generated entry.
• groupOf puts 0 of the 108 in a group other than the one they were listed under.
• changelogSection('0.5.3', '2026-10-19', those 108) minus its heading equals base's block exactly: 123 lines both ways, same order. Its heading line equals base's old heading.
• Of the lines the diff removes, 0 are missing from the generated output.
• All 108 PRs are among prNumbers(git log --first-parent v0.5.2..71316ebd) (109 PRs). So release.mjs changelog 0.5.3 will find them again.
• withSection(head, '0.5.3', changelogSection('0.5.3', …)) with 0 PRs, 1 PR and the 108 PRs drops 0 lines of head's section, keeps 148/148 hand-written lines, and leaves every other section unchanged.
• Without this PR's list removal, undating only the heading on base gives 114 lines the release would drop, the first being - Pin the engine to v0.5.2 (#578). That is the builder's stated reason for removing the lists, and the "an unreleased section is all hand-written" test would fail on it.

Tests on the head (measured, in my worktree, built with npx tsc -p tsconfig.json)

• node --import ./dist/test/isolate.js --test dist/test/changelog.test.js dist/test/comment-policy-cli.test.js: 15 pass, 0 fail. 10 of the 15 are changelog.test.js.
• owner-terminal-removed: I read the PATH its tests set first. Its other tests use <bin>:/usr/bin:/bin, so I ran none of them locally. CI runs them. I ran only the CHANGELOG test (--test-name-pattern="one placeholder version"), which only reads files: 1 pass, 0 fail.
• npm run check:denylist: denylist: 1309 files clean.
• Not run locally: npm test, release.test.ts, the escape fixture and the mcp-broker tests. The Node 24 CI shards ran them green (measured, gh pr checks 850).

Fail-without

No code or test change, so there is no new test to fail on main. The relevant existing test is changelog.test.ts "an unreleased section is all hand-written…". The in-memory run above shows it would flag 114 lines on a heading-only undate (measured), and it passes on this head (measured).

Protection

Not protected (measured). CHANGELOG.md matches nothing in .worklane/review.yaml or src/review.ts: grep finds no CHANGELOG, and the only root-level globs are .denylist* and .gitleaks*. The PR is correctly marked docs-only. No regression for existing installs (inferred): CHANGELOG.md isn't packaged, and no code, config or setup file changes.

Scope

Nothing beyond the owner decision (measured): one file, heading plus generated lists. The empty closing ### Guardrail changes heading is kept, which main's lib needs to end the hand-written notes.

Hygiene

• Commit 54b3eb1 has Signed-off-by: Jayden Vasquez, with no Co-Authored-By or "Generated with" line (measured, git log --format=%B -1).
• No attribution line in the PR body (measured).
• The body's claims are labelled measured or inferred, and it has an Adversarial pass section (measured).
• No new dependencies (measured: new-deps pass). dco, denylist, push-gate and scope pass (measured).
• No Closes #N (measured). This PR carries out an owner decision, and I found no issue for it. Release: an (unreleased) CHANGELOG section survives release.mjs whole, by design (no heading-layout rule) #811 (an unreleased section that survives release.mjs by design) is related but isn't closed by this PR (inferred). Not a required change.

Required changes

None.