the release derivation cannot tell a back-filled resolution from a fresh one, so a ledger hygiene sweep re-announces old work as this release's content. internal/core/release/emit.go and internal/core/changelog/shipped.go read only folder membership and the record's impact field; neither reads resolved_by. The cut therefore equates 'record entered resolved/ since the base tag' with 'shipped in this release'. That equation holds only because RS001 now lands resolution inside the fixing commit, and a bulk hygiene sweep is the legitimate exception. Live instance: the 2026-08-24 sweep (089c0d61) closed 33 already-fixed records, and the v0.6.4 cut renders 14 of them as changelog entries for work first tagged v0.4.0, v0.4.1, v0.4.2 and v0.6.2 — four of the 14 are already cited by id under the 0.6.2 heading. The four records deciding the additive impact class (iss-98, iss-99, iss-100, iss-158) all describe pre-v0.6.3 work, so the version and the receipt tier rest on them too. Candidate fix: exclude an added record whose resolved_by.commit is reachable from the base tag, which needs the stamp back-filled on the six swept records that carry none.

Frontmatter

.abcd/work/issues/resolved/iss-2608241612087533-the-release-derivation-cannot-tell-a.md
open on GitHub ↗ · commit history ↗

mentions6

• dcn-26082600000000032026-08-26 — The changelog is an INDEX of record transitions, not a curated
• iss-98disembark evidence/what-didnt grounds only on git reverts; repos that abandon via deletion or dead branches (not revert) report blank. Extend the Tier-0 adapter to also read files deleted after substantial history and branches abandoned unmerged — the graveyard adapter already gathers this.
• iss-99disembark has no adapter scanning code for TODO/FIXME markers, so evidence/open-questions is blank on any repo without a native record even when the code is full of TODOs. Add a conventions-tier adapter that greps tracked files for TODO/FIXME/XXX.
• iss-100disembark has no conventions-tier adapters for constraints/naming, glossary, or internals, so these ground only from an authored abcd brief. Add adapters reading GLOSSARY.md / docs/glossary (naming, glossary) and docs/architecture / package layout (internals) so a repo with conventional docs but no abcd record still grounds them.
• iss-158no commit-time gate for user-private identifiers: the canonical home for this is itd-74 (name-banlist, in drafts/) — its private-banlist layer (local untracked file + committed guard hook, refuse by entry-key only, never echoing the value) is exactly the gate this incident needed. This issue is NOT a new primitive: it records the field evidence that itd-74's scope must include machine identifiers (hostnames, tailnet IPs/prefixes, device names), not only harness/project names, and that the incident strengthens the case for promoting itd-74 out of drafts (a maintainer decision). Generic patterns (iss-154/157) catch shapes; only the banlist catches this user's actual names. Prior art at skill level: the confidential-sources sync-banlist guard; dogfood prototype already live per itd-74's own record. Complements, does not replace, iss-154.
• less-but-betterLess, but better